📦

Audit History

allaymc-plugin-dev - 6 audits

Audit version 6

Latest Low Risk

Jun 28, 2026, 09:19 AM

Static analysis reported many high-risk patterns, but manual review found they come from LGPL license prose, Markdown code formatting, and legitimate git or Gradle workflow examples. No prompt injection, credential access, data exfiltration, obfuscated code, or malicious network behavior was found in LICENSE, README.md, or SKILL.md. The skill is low risk because it can guide users or agents to run standard development commands and read local reference paths.

3
Files scanned
647
Lines analyzed
6
findings
codex
Audited by
Low Risk Issues (4)
Static License Text Matches Are False Positives
Verdict: FALSE_POSITIVE. The reported weak cryptography and reconnaissance hits in LICENSE are standard LGPL prose. The cited lines contain license language about software freedom, libraries, source copies, offers, and operating systems, not executable code or cryptographic APIs.
Markdown Backticks Flagged as Shell Execution
Verdict: FALSE_POSITIVE with a low operational caution. README.md and SKILL.md use Markdown backticks and fenced bash examples for installation, updates, and AllayGradle build tasks. These are transparent developer commands, not hidden Ruby backtick execution or command injection.
Path References Are Documentation, Not Traversal
Verdict: FALSE_POSITIVE with a low operational caution. README.md references installation directories, including a Codex skills path, and SKILL.md references template and API paths under references. The ellipsis in a Java source path is explanatory shorthand, not a traversal directive outside the project.
Skill Metadata Keyword Matches Are False Positives
Verdict: FALSE_POSITIVE. Static hits in SKILL.md around the description, Gradle metadata, lifecycle heading, and API mismatch troubleshooting are ordinary AllayMC plugin guidance. They do not show weak cryptography, network reconnaissance, or system reconnaissance intent.

Audit version 5

Safe

Jan 16, 2026, 03:04 PM

This is a prompt-only documentation skill containing guidance for AllayMC plugin development. No executable code, scripts, network operations, or file system access beyond the skill's own directory. Static findings are false positives triggered by markdown documentation patterns (backticks in code blocks) and LGPL-2.1 license legal text. The skill reads reference materials via user-initialized git submodules.

4
Files scanned
858
Lines analyzed
2
findings
claude
Audited by
No security issues found

Audit version 4

Safe

Jan 16, 2026, 03:04 PM

This is a prompt-only documentation skill containing guidance for AllayMC plugin development. No executable code, scripts, network operations, or file system access beyond the skill's own directory. Static findings are false positives triggered by markdown documentation patterns (backticks in code blocks) and LGPL-2.1 license legal text. The skill reads reference materials via user-initialized git submodules.

4
Files scanned
858
Lines analyzed
2
findings
claude
Audited by
No security issues found

Audit version 3

Safe

Jan 10, 2026, 10:15 AM

This is a prompt-only skill containing documentation and guidance for AllayMC plugin development. No executable code, scripts, network operations, or file system access beyond the skill's own directory. References external git submodules that are initialized by the user.

4
Files scanned
653
Lines analyzed
0
findings
claude
Audited by
No security issues found

Audit version 2

Safe

Jan 10, 2026, 10:15 AM

This is a prompt-only skill containing documentation and guidance for AllayMC plugin development. No executable code, scripts, network operations, or file system access beyond the skill's own directory. References external git submodules that are initialized by the user.

4
Files scanned
653
Lines analyzed
0
findings
claude
Audited by
No security issues found

Audit version 1

Safe

Jan 10, 2026, 10:15 AM

This is a prompt-only skill containing documentation and guidance for AllayMC plugin development. No executable code, scripts, network operations, or file system access beyond the skill's own directory. References external git submodules that are initialized by the user.

4
Files scanned
653
Lines analyzed
0
findings
claude
Audited by
No security issues found