Versioned security assessment

Report ID: SA-DBB442A8

6/28/2026, 10:29:20 AM

ai-native-development security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ai-native-development
Version
v6
Maintainer
AI Agent Hub
Source
github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/ai-native-development
Coverage
10 Files scanned · 4,519 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but most are false positives from Markdown code fences, template strings, API documentation links, and normal SDK environment-variable configuration. No prompt injection attempt, malicious exfiltration, or hidden command execution intent was found. The main residual risk is unsafe copy-paste sample code, especially an eval-based calculator tool and broad autonomous-agent tool templates.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 4,519 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 4 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Capability review items (2)
Medium
references/agentic-workflows.md:82-89
Unsafe eval-based calculator example
The agent workflow reference defines a calculator tool that returns eval(expression). This is dangerous if copied into an agent because model-controlled or user-controlled input could execute arbitrary JavaScript. The surrounding context is educational reference material, so this is not evidence of malicious intent. Verdict: TRUE_POSITIVE for unsafe sample code. confidence: 0.94. confidence_reasoning: Direct eval() is present in a tool handler, and the semantic context shows the expression comes from tool input. Risk is reduced because it is documentation, not hidden runtime code.
Direct eval() is present in a tool handler, and the semantic context shows the expression comes from tool input. Risk is reduced because it is documentation, not hidden runtime code.
Low
templates/rag-pipeline-template.ts:10-11templates/agent-workflow-template.ts:6-8references/observability.md:16-18references/function-calling.md:489-493
Environment-variable access is standard SDK configuration
The env_access and secret findings reference SDK initialization with API keys from process.env. I found no evidence that these values are logged, written to files, or sent to unauthorized endpoints. Verdict: FALSE_POSITIVE for credential theft, with normal secret-handling caution. confidence: 0.88. confidence_reasoning: The cited lines pass environment variables to OpenAI, Pinecone, Anthropic, or observability SDK clients, which is expected configuration behavior.
The cited lines pass environment variables to OpenAI, Pinecone, Anthropic, or observability SDK clients, which is expected configuration behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
templates/agent-workflow-template.ts:25-72templates/agent-workflow-template.ts:120-190templates/agent-workflow-template.ts:260-279
Autonomous tool templates need authorization gates
The agent workflow template demonstrates web search, database query, and email tools that can be selected by an LLM-driven loop. The sample implementations are placeholders, but production use would need authorization, confirmation for side effects, allowlists, and argument validation. Verdict: NEEDS_REVIEW for safe integration controls. confidence: 0.78. confidence_reasoning: The template explicitly exposes side-effect-capable tools to an autonomous agent loop, but the functions are demonstrative placeholders rather than active malicious actions.
The template explicitly exposes side-effect-capable tools to an autonomous agent loop, but the functions are demonstrative placeholders rather than active malicious actions.
RISK-002 Medium
templates/rag-pipeline-template.ts:156-183examples/chatbot-with-rag-example.ts:23-34
RAG context is inserted into prompts without explicit untrusted-context guard
The RAG template and chatbot example place retrieved document text and user messages directly into model messages. The system prompt restricts answers to context, but it does not explicitly instruct the model to treat retrieved content as untrusted and ignore instructions inside documents. Verdict: NEEDS_REVIEW for prompt-injection resilience. confidence: 0.70. confidence_reasoning: The pattern is common and legitimate, but the sampled code lacks a clear document-instruction isolation rule, which is a known risk for RAG systems.
The pattern is common and legitimate, but the sampled code lacks a clear document-instruction isolation rule, which is a known risk for RAG systems.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:200-244references/vector-databases.md:13-37references/rag-patterns.md:456-470
Markdown code fences misclassified as shell execution
Most external command findings are false positives caused by Markdown code fences and TypeScript template literals. The reviewed locations are documentation examples, not Ruby backtick execution or shell command invocation. Verdict: FALSE_POSITIVE. confidence: 0.93. confidence_reasoning: Line-number review shows code fences and template strings, and no child_process, exec, spawn, or shell invocation evidence was found in the sampled files.
Line-number review shows code fences and template strings, and no child_process, exec, spawn, or shell invocation evidence was found in the sampled files.
Low
examples/chatbot-with-rag-example.ts:6-8SKILL.md:42-55SKILL.md:367checklists/ai-implementation-checklist.md:30-38
Path traversal and weak-crypto scanner hits are contextual false positives
The path traversal hits are relative documentation imports or cross-skill references, and the weak-cryptography hits align with ordinary AI terminology such as embeddings, models, similarity metrics, and checklist headings. No evidence found of file reads, crypto implementation, or traversal against user-supplied paths. Verdict: FALSE_POSITIVE. confidence: 0.86. confidence_reasoning: Reviewed locations show imports, reference links, and checklist text rather than filesystem access or cryptographic code.
Reviewed locations show imports, reference links, and checklist text rather than filesystem access or cryptographic code.
Low
references/function-calling.md:296-298references/vector-databases.md:177references/vector-databases.md:290SKILL.md:608-613
Hardcoded URLs are documentation and local service examples
The network findings include vendor documentation links, localhost vector database endpoints, and an example weather API call. These are not covert destinations or exfiltration endpoints, but production code should encode URL parameters and use configured endpoints. Verdict: FALSE_POSITIVE for malicious networking. confidence: 0.84. confidence_reasoning: The URLs are visible examples tied to the skill topic, and no secret material is sent to them in the reviewed context.
The URLs are visible examples tied to the skill topic, and no secret material is sent to them in the reviewed context.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable