Skills llm-doc-writer Audit History
📦

Audit History

llm-doc-writer - 10 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v10 LatestJul 7, 2026, 05:47 PM No confirmed findings0No capability change
v9 Jul 7, 2026, 05:47 PM No confirmed findings0No capability change
v8 Jul 6, 2026, 01:37 AM No confirmed findings0External commandsNetwork access
v7 Jun 28, 2026, 04:42 AM No confirmed findings0No capability change
v6 Jan 21, 2026, 02:49 PM No confirmed findings0 External commandsNetwork access
v5 Jan 16, 2026, 03:09 PM No confirmed findings0No capability change
v4 Jan 16, 2026, 03:09 PM No confirmed findings0External commandsNetwork access
v3 Jan 10, 2026, 09:55 AM No confirmed findings0No capability change
v2 Jan 10, 2026, 09:55 AM No confirmed findings0No capability change
v1 Jan 10, 2026, 09:55 AM No confirmed findings0Baseline

Jul 7, 2026, 05:47 PM

All static findings are false positives from Markdown examples, code fences, command tables, and prose architecture examples. I found no executable scripts, no actual network calls, and no prompt injection content in SKILL.md or patterns.md.

2
Files scanned
282
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 7, 2026, 05:47 PM

All static findings are false positives from Markdown examples, code fences, command tables, and prose architecture examples. I found no executable scripts, no actual network calls, and no prompt injection content in SKILL.md or patterns.md.

2
Files scanned
282
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 6, 2026, 01:37 AM

All static findings are false positives caused by Markdown fences, inline command examples, headings, or prose references in documentation. No executable scripts, runtime network calls, data exfiltration intent, or prompt injection language were found in SKILL.md or patterns.md.

2
Files scanned
282
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jun 28, 2026, 04:42 AM

Static analysis reported external command, network, weak crypto, and reconnaissance patterns. Manual review found only markdown examples, inline code formatting, and ordinary documentation text, with no executable code or malicious intent.

2
Files scanned
282
Lines analyzed
0
Review items
4
False positives ignored
Static false positives ignored (4)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
False Positive: Markdown Backticks Misread as Shell Execution
The external command detections are markdown fences or inline command examples. No Ruby code, shell execution logic, or user-controlled command invocation was found.
Both scanned files are markdown documentation. The flagged locations are code fences, inline command examples, or formatting markers, not executable Ruby backtick calls.
Low
False Positive: Weak Crypto Pattern in Documentation Text
The weak cryptography detections match ordinary words and markdown references. No hashing, encryption, signing, or credential handling implementation was found.
Manual review found no cryptographic code. The lines contain documentation prose, headers, or references such as CLAUDE.md.
Low
False Positive: Network Pattern in Architecture Example
The network detection appears in a prose example about REST APIs between services. No Python HTTP library import, endpoint, or outbound request code was found.
The line is inside a before-and-after documentation example. It describes architecture communication and does not perform network activity.
Low
False Positive: Reconnaissance Pattern in Section Heading
The reconnaissance detection maps to an anti-patterns heading. No host, user, process, environment, or filesystem discovery command was found.
The flagged line is a markdown heading introducing writing anti-patterns. There is no executable system reconnaissance behavior in the file.
No confirmed security findings were recorded for this completed audit.
Audited by: codex

Jan 21, 2026, 02:49 PM

All 55 static findings are false positives. The scanner misidentified markdown documentation syntax as security issues. Backticks are markdown code fences, not shell execution. RabbitMQ and JWT mentions are technology references, not weak crypto. The skill contains only documentation patterns and has no actual code execution, network calls, or cryptographic operations.

3
Files scanned
926
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 10, 2026, 09:55 AM

Pure prompt-based documentation skill with no code execution, filesystem access, network calls, or system modifications. Contains only instructional markdown content with writing guidelines and examples.

2
Files scanned
282
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 10, 2026, 09:55 AM

Pure prompt-based documentation skill with no code execution, filesystem access, network calls, or system modifications. Contains only instructional markdown content with writing guidelines and examples.

2
Files scanned
282
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 10, 2026, 09:55 AM

Pure prompt-based documentation skill with no code execution, filesystem access, network calls, or system modifications. Contains only instructional markdown content with writing guidelines and examples.

2
Files scanned
282
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude