📦

Audit History

inbox-placement-monitor - 10 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v10 LatestJul 26, 2026, 10:21 AM No confirmed findings1No capability change
v9 Jul 26, 2026, 10:21 AM No confirmed findings1No capability change
v8 Jul 13, 2026, 01:46 PM No confirmed findings1No capability change
v7 Jul 13, 2026, 01:46 PM No confirmed findings1No capability change
v6 Jul 12, 2026, 12:30 PM 2 confirmed1No capability change
v5 Jul 10, 2026, 10:59 AM No confirmed findings2No capability change
v4 Jul 9, 2026, 11:51 AM No confirmed findings1No capability change
v3 Jul 6, 2026, 05:22 PM No confirmed findings1No capability change
v2 Jul 6, 2026, 05:22 PM No confirmed findings1No capability change
v1 Jul 4, 2026, 04:13 PM No confirmed findings1Baseline

Jul 26, 2026, 10:21 AM

One finding is confirmed: SKILL.md documents a Python connector whose --live mode sends seed emails through Resend. The other 54 alerts are Markdown links, code formatting, metadata URLs, or benign monitoring language; no prompt injection was found.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
The line documents a Python connector command whose --live option sends seed emails through Resend. Dry-run defaults reduce exposure, but the outbound side effect is real.
Audited by: claude

Jul 26, 2026, 10:21 AM

One finding is confirmed: SKILL.md documents a Python connector whose --live mode sends seed emails through Resend. The other 54 alerts are Markdown links, code formatting, metadata URLs, or benign monitoring language; no prompt injection was found.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
The line documents a Python connector command whose --live option sends seed emails through Resend. Dry-run defaults reduce exposure, but the outbound side effect is real.
Audited by: claude

Jul 13, 2026, 01:46 PM

Fifty-four of 55 static alerts are false positives caused by Markdown backticks, relative documentation links, homepage metadata, or ordinary workflow prose. The command on SKILL.md line 52 is a genuine external action because --live sends email through Resend, but dry-run is the documented default. No prompt injection or hidden data-exfiltration intent was found.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
SKILL.md line 52 instructs the agent to invoke a Python connector, and the optional --live flag sends email through Resend. This is a real external command with network side effects, although dry-run is the documented default.
Audited by: codex

Jul 13, 2026, 01:46 PM

Fifty-four of 55 static alerts are false positives caused by Markdown backticks, relative documentation links, homepage metadata, or ordinary workflow prose. The command on SKILL.md line 52 is a genuine external action because --live sends email through Resend, but dry-run is the documented default. No prompt injection or hidden data-exfiltration intent was found.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
SKILL.md line 52 instructs the agent to invoke a Python connector, and the optional --live flag sends email through Resend. This is a real external command with network side effects, although dry-run is the documented default.
Audited by: codex

Jul 12, 2026, 12:30 PM

Most static alerts are false positives caused by Markdown backticks, fixed documentation links, and homepage metadata. The skill does include an intentional live Resend command, and its save template lacks explicit filename sanitization guidance.

2
Files scanned
130
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
Live Outbound Email Action
The documented --live workflow sends one message per seed inbox through Resend. This external side effect can disclose campaign content and recipient addresses to the configured email service.
Line 52 explicitly states that --live fires the seed test through a batch endpoint, while dry-run is the default.
Medium
User-Derived Save Filename Lacks Sanitization Guidance
The save template places a domain or topic in a filename without requiring normalization. Unsafe separator or parent-directory input could redirect a write outside the intended memory folder.
Line 70 directly uses <domain-or-topic> in the destination filename, but the underlying host may independently sanitize generated paths.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
Line 52 instructs the agent to run a Python connector and permits --live, which sends messages through Resend. This is intentional functionality but creates command and external network side effects.
Audited by: codex

Jul 10, 2026, 10:59 AM

Most static findings are false positives caused by Markdown backticks, code fences, repository links, and homepage metadata. Two findings are confirmed: the live seed-send command can transmit email, and the dynamic save filename lacks a required path-normalization rule. No prompt injection, credential exfiltration, or malicious reconnaissance intent was found.

2
Files scanned
130
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Path traversal sequence
After delivering, ask "Save these results for future sessions?" If yes, write the placement + reputa
The save path directly interpolates <domain-or-topic> without a normalization requirement. A value containing separators or .. could escape the intended memory directory.
Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
This line provides a real Python command whose --live flag sends outbound seed emails. The action is legitimate but consequential and requires explicit user approval.
Audited by: codex

Jul 9, 2026, 11:51 AM

Most static findings are false positives from Markdown links, inline code formatting, example prompts, and homepage metadata. One medium issue remains: SKILL.md line 52 documents an optional python3 helper that can send live seed emails through Resend. No prompt injection, credential exfiltration, or malicious intent was found.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
Line 52 documents a real python3 command that can send live seed emails through Resend when --live is used. This is a legitimate feature, but it is an external command with network side effects and should require explicit confirmation.
Audited by: codex

Jul 6, 2026, 05:22 PM

Most static findings are false positives caused by Markdown code fences, inline SEND-S notation, and relative links to documentation. One medium-risk finding is confirmed: SKILL.md line 52 gives a Python helper command that can send live seed emails through Resend when run with --live. No prompt injection or data-exfiltration intent was found in the reviewed files.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
SKILL.md line 52 gives a literal python3 helper command that can send live seed emails through Resend when run with --live. This is legitimate automation, but it is external command execution with outbound email side effects.
Audited by: codex

Jul 6, 2026, 05:22 PM

Most static findings are false positives caused by Markdown code fences, inline SEND-S notation, and relative links to documentation. One medium-risk finding is confirmed: SKILL.md line 52 gives a Python helper command that can send live seed emails through Resend when run with --live. No prompt injection or data-exfiltration intent was found in the reviewed files.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
SKILL.md line 52 gives a literal python3 helper command that can send live seed emails through Resend when run with --live. This is legitimate automation, but it is external command execution with outbound email side effects.
Audited by: codex

Jul 4, 2026, 04:13 PM

No prompt injection, malicious data exfiltration, arbitrary path traversal, or hidden reconnaissance intent was found in the reviewed files. Most static alerts are Markdown links or inline-code false positives; one documented Resend seed-send command is a real medium-risk external command because it can send live email with --live.

2
Files scanned
130
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency seed-send automation (when Resend is the ESP)**: `python3 "${CLAUDE_PLUGIN_ROOT}/s
Line 52 instructs the agent to run a local Python connector with --live, which can send real seed emails through Resend. The path is fixed and dry-run is documented, but the live external side effect requires explicit confirmation.
Audited by: codex