Skills fit-scorer Audit History
πŸ“¦

Audit History

fit-scorer - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v7 LatestJul 12, 2026, 12:27 PM No confirmed findings4No capability change
v6 Jul 12, 2026, 12:27 PM No confirmed findings4No capability change
v5 Jul 10, 2026, 10:56 AM 1 confirmed1No capability change
v4 Jul 9, 2026, 11:48 AM No confirmed findings2No capability change
v3 Jul 6, 2026, 05:17 PM No confirmed findings1No capability change
v2 Jul 6, 2026, 05:17 PM No confirmed findings1No capability change
v1 Jul 4, 2026, 04:04 PM No confirmed findings1Baseline

Jul 12, 2026, 12:27 PM

Most findings are scanner false positives caused by Markdown code fences, inline code, and relative documentation links. The skill explicitly runs local Python tooling, uses shell command substitution, and expects a YouTube API key. No prompt injection or data-exfiltration intent was found in the reviewed files.

2
Files scanned
507
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The workflow expects YOUTUBE_API_KEY and invokes a connector that can consume this secret-bearing environment value. The use appears legitimate, but the connector process receives credential access.
Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to run a local Python YouTube connector. The executable and script path are fixed, but this remains external command execution with a creator handle argument.
Medium
Ruby/shell backtick execution
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The inline shell example runs git to resolve a root and then executes rubric-score.py. This is explicit external command execution, not only Markdown formatting.
Medium
Shell command substitution
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The root-resolution expression contains $(git rev-parse ...), which executes git in a shell. It is a fixed command, but its result controls the later script path.
Audited by: codex

Jul 12, 2026, 12:27 PM

Most findings are scanner false positives caused by Markdown code fences, inline code, and relative documentation links. The skill explicitly runs local Python tooling, uses shell command substitution, and expects a YouTube API key. No prompt injection or data-exfiltration intent was found in the reviewed files.

2
Files scanned
507
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The workflow expects YOUTUBE_API_KEY and invokes a connector that can consume this secret-bearing environment value. The use appears legitimate, but the connector process receives credential access.
Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to run a local Python YouTube connector. The executable and script path are fixed, but this remains external command execution with a creator handle argument.
Medium
Ruby/shell backtick execution
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The inline shell example runs git to resolve a root and then executes rubric-score.py. This is explicit external command execution, not only Markdown formatting.
Medium
Shell command substitution
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The root-resolution expression contains $(git rev-parse ...), which executes git in a shell. It is a fixed command, but its result controls the later script path.
Audited by: codex

Jul 10, 2026, 10:56 AM

Most static findings are false positives caused by Markdown fences, inline code, and relative documentation links. One command-execution finding is confirmed because the skill directs an agent to run a Python connector with a user-provided handle without explicit argument validation. The skill also persists campaign and creator assessments to shared memory paths, creating a privacy and retention concern.

2
Files scanned
516
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Persistent storage of campaign and creator assessments
The skill reads campaign and creator records, then requires saving detailed scores and promoting handles and verdicts to shared memory. This can retain sensitive campaign strategy and reputational assessments without explicit consent or retention controls.
The read, write, and promotion behavior is explicitly required in the skill contract and final instruction. No consent, scoping, deletion, or retention guidance appears in the reviewed files.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to execute a Python connector command. The creator handle is user-supplied, and the guidance does not specify validation or shell-safe argument handling.
Audited by: codex

Jul 9, 2026, 11:48 AM

Most static findings are false positives from Markdown links, inline file paths, or prompt examples. One connector command and one YouTube API key reference are confirmed because they require external command execution and secret-bearing environment access.

2
Files scanned
516
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
Line 58 references YOUTUBE_API_KEY for connector use, which is a secret-bearing environment variable. There is no exfiltration evidence, but the skill depends on sensitive environment access.
Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill instructs the agent to run python3 against a connector script using a user-supplied handle placeholder. The purpose is legitimate, but it is still external command execution that needs explicit permission and argument validation.
Audited by: codex

Jul 6, 2026, 05:17 PM

Static alerts were mostly caused by Markdown fences, inline paths, and repository documentation links. I confirmed one medium-risk issue: the skill shows a shell-style YouTube connector command using a candidate handle, which needs validation and non-shell execution guidance. No prompt injection, credential exfiltration, or unauthorized network endpoint was found in the scanned files.

2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval.
Audited by: codex

Jul 6, 2026, 05:17 PM

Static alerts were mostly caused by Markdown fences, inline paths, and repository documentation links. I confirmed one medium-risk issue: the skill shows a shell-style YouTube connector command using a candidate handle, which needs validation and non-shell execution guidance. No prompt injection, credential exfiltration, or unauthorized network endpoint was found in the scanned files.

2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval.
Audited by: codex

Jul 4, 2026, 04:04 PM

Most static findings are false positives from Markdown code fences, static repository links, metadata URLs, and fixed memory paths. One confirmed issue remains: the skill tells agents to run a local YouTube connector with a user-supplied handle, so handle validation and execution confirmation are needed. No prompt injection, social engineering, or data-exfiltration intent was found in the reviewed files.

2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
Line 58 instructs the agent to run a local Python connector with a creator handle supplied by the user. Without explicit handle validation and confirmation, that external command path is a real execution surface.
Audited by: codex