Audit History
inbox-placement-monitor - 10 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v10 Latest | Jul 26, 2026, 10:21 AM | No confirmed findings | 1 | No capability change |
| v9 | Jul 26, 2026, 10:21 AM | No confirmed findings | 1 | No capability change |
| v8 | Jul 13, 2026, 01:46 PM | No confirmed findings | 1 | No capability change |
| v7 | Jul 13, 2026, 01:46 PM | No confirmed findings | 1 | No capability change |
| v6 | Jul 12, 2026, 12:30 PM | 2 confirmed | 1 | No capability change |
| v5 | Jul 10, 2026, 10:59 AM | No confirmed findings | 2 | No capability change |
| v4 | Jul 9, 2026, 11:51 AM | No confirmed findings | 1 | No capability change |
| v3 | Jul 6, 2026, 05:22 PM | No confirmed findings | 1 | No capability change |
| v2 | Jul 6, 2026, 05:22 PM | No confirmed findings | 1 | No capability change |
| v1 | Jul 4, 2026, 04:13 PM | No confirmed findings | 1 | Baseline |
Jul 26, 2026, 10:21 AM
One finding is confirmed: SKILL.md documents a Python connector whose --live mode sends seed emails through Resend. The other 54 alerts are Markdown links, code formatting, metadata URLs, or benign monitoring language; no prompt injection was found.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 26, 2026, 10:21 AM
One finding is confirmed: SKILL.md documents a Python connector whose --live mode sends seed emails through Resend. The other 54 alerts are Markdown links, code formatting, metadata URLs, or benign monitoring language; no prompt injection was found.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 13, 2026, 01:46 PM
Fifty-four of 55 static alerts are false positives caused by Markdown backticks, relative documentation links, homepage metadata, or ordinary workflow prose. The command on SKILL.md line 52 is a genuine external action because --live sends email through Resend, but dry-run is the documented default. No prompt injection or hidden data-exfiltration intent was found.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 13, 2026, 01:46 PM
Fifty-four of 55 static alerts are false positives caused by Markdown backticks, relative documentation links, homepage metadata, or ordinary workflow prose. The command on SKILL.md line 52 is a genuine external action because --live sends email through Resend, but dry-run is the documented default. No prompt injection or hidden data-exfiltration intent was found.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 12, 2026, 12:30 PM
Most static alerts are false positives caused by Markdown backticks, fixed documentation links, and homepage metadata. The skill does include an intentional live Resend command, and its save template lacks explicit filename sanitization guidance.
Confirmed security concerns (2)
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 10, 2026, 10:59 AM
Most static findings are false positives caused by Markdown backticks, code fences, repository links, and homepage metadata. Two findings are confirmed: the live seed-send command can transmit email, and the dynamic save filename lacks a required path-normalization rule. No prompt injection, credential exfiltration, or malicious reconnaissance intent was found.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 9, 2026, 11:51 AM
Most static findings are false positives from Markdown links, inline code formatting, example prompts, and homepage metadata. One medium issue remains: SKILL.md line 52 documents an optional python3 helper that can send live seed emails through Resend. No prompt injection, credential exfiltration, or malicious intent was found.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 6, 2026, 05:22 PM
Most static findings are false positives caused by Markdown code fences, inline SEND-S notation, and relative links to documentation. One medium-risk finding is confirmed: SKILL.md line 52 gives a Python helper command that can send live seed emails through Resend when run with --live. No prompt injection or data-exfiltration intent was found in the reviewed files.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 6, 2026, 05:22 PM
Most static findings are false positives caused by Markdown code fences, inline SEND-S notation, and relative links to documentation. One medium-risk finding is confirmed: SKILL.md line 52 gives a Python helper command that can send live seed emails through Resend when run with --live. No prompt injection or data-exfiltration intent was found in the reviewed files.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
📁 Filesystem access (22)
⚙️ External commands (27)
🌐 Network access (2)
Jul 4, 2026, 04:13 PM
No prompt injection, malicious data exfiltration, arbitrary path traversal, or hidden reconnaissance intent was found in the reviewed files. Most static alerts are Markdown links or inline-code false positives; one documented Resend seed-send command is a real medium-risk external command because it can send live email with --live.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.