📦

Audit History

email-quality-auditor - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v7 LatestJul 26, 2026, 10:14 AM No confirmed findings0No capability change
v6 Jul 26, 2026, 10:14 AM No confirmed findings0No capability change
v5 Jul 13, 2026, 01:23 PM No confirmed findings0No capability change
v4 Jul 13, 2026, 01:23 PM No confirmed findings0No capability change
v3 Jul 12, 2026, 12:09 PM No confirmed findings1No capability change
v2 Jul 6, 2026, 04:52 PM 2 confirmed3No capability change
v1 Jul 4, 2026, 04:03 PM No confirmed findings0Baseline

Jul 26, 2026, 10:14 AM

All 34 static findings are false positives caused by Markdown backticks, fixed local reference links, and homepage metadata. The reviewed instructions emphasize evidence-based email audits, prohibit autonomous sending and provider changes, and require explicit authorization before persistence. No prompt injection, exfiltration intent, or user-controlled command or path execution was found.

2
Files scanned
374
Lines analyzed
3
Review items
0
False positives ignored
Audited by: claude

Jul 26, 2026, 10:14 AM

All 34 static findings are false positives caused by Markdown backticks, fixed local reference links, and homepage metadata. The reviewed instructions emphasize evidence-based email audits, prohibit autonomous sending and provider changes, and require explicit authorization before persistence. No prompt injection, exfiltration intent, or user-controlled command or path execution was found.

2
Files scanned
374
Lines analyzed
3
Review items
0
False positives ignored
Audited by: claude

Jul 13, 2026, 01:23 PM

All 33 static alerts were adjudicated as false positives. The evidence consists of Markdown syntax, fixed repository references, metadata URLs, and a fixed local Git lookup without user-controlled arguments. No semantic threat or prompt injection was found.

2
Files scanned
372
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex

Jul 13, 2026, 01:23 PM

All 33 static alerts were adjudicated as false positives. The evidence consists of Markdown syntax, fixed repository references, metadata URLs, and a fixed local Git lookup without user-controlled arguments. No semantic threat or prompt injection was found.

2
Files scanned
372
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex

Jul 12, 2026, 12:09 PM

Most static findings are Markdown formatting, metadata URLs, fixed documentation links, or a controlled Git command without user-controlled arguments. The direct instruction to read parent-directory references crosses the packaged skill boundary and remains a confirmed filesystem concern.

2
Files scanned
372
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Path traversal sequence
Read `../../../references/auditor-runbook.md`, `scoring-semantics.md`, `send-benchmark.md`, and the
The runtime instruction explicitly tells the agent to read files through ../../../ paths outside the packaged skill directory. Those cross-boundary reads are unnecessary because a bundled runtime is available.
Audited by: codex

Jul 6, 2026, 04:52 PM

Most static alerts are false positives from Markdown backticks and fixed relative documentation links. Confirmed risks are limited to optional connector command use, a runtime GitHub reference fetch, mutable remote instruction dependencies, and persistent audit artifacts.

1
Files scanned
209
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
Remote Mutable Reference Dependency
The standalone fallback tells the agent to fetch runbooks and other named references from GitHub raw URLs at runtime. This can import changed instructions that were not bundled or reviewed with the skill.
Line 99 explicitly instructs fetching external reference files when local relative paths are absent. The risk is supply-chain drift rather than direct exfiltration.
Medium
Automatic Persistence of Audit Results
The skill instructs the agent to write audit artifacts and promote vetoes or fixes into memory files. Email audits can include sensitive campaign, consent, suppression, or revenue evidence.
The cited lines require persistent local writes for audit output and hot-cache/open-loops summaries. The exact data saved depends on user evidence, so the privacy impact is contextual.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency evidence pull (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/
The line tells the agent to run python3 connector scripts with user-provided domains or contact IDs. Even if read-only, this is real external command use that can touch local scripts and remote service data.
Medium
Ruby/shell backtick execution
Before a broadcast or flow first goes live (as opposed to the full four-dimension EQS audit above),
The go/no-go checklist uses resend.py contacts as platform verification for suppression status. This is legitimate email QA, but it is still external connector use with potentially sensitive identifiers.
Low
Hardcoded URL
*Standalone install fallback*: if that relative path does not exist, this skill was installed standa
The standalone fallback tells the agent to fetch reference files from raw.githubusercontent.com at runtime. This is a real external network dependency, though it is not evidence of data exfiltration.
Audited by: codex

Jul 4, 2026, 04:03 PM

The static findings are false positives caused by Markdown code spans, repository-relative links, fixed memory paths, and documentation URLs. Line 89 documents constrained, read-only helper commands for deliverability evidence; I found no prompt injection, exfiltration, destructive command, or path traversal intent.

1
Files scanned
209
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex