Versioned security assessment

Report ID: SA-235D909C

6/28/2026, 10:43:09 AM

type-safety-validation security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
type-safety-validation
Version
v7
Maintainer
AI Agent Hub
Source
github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/type-safety-validation
Coverage
1 Files scanned · 326 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Low

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static analyzer flagged many high-risk patterns, but review shows they are markdown code fences, TypeScript examples, documentation URLs, and relative imports. No malicious behavior or prompt injection was found. One low-risk documentation issue remains because a sample tRPC mutation uses publicProcedure without showing authentication.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 326 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 6 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 22 evidence locations

Capability review items (1)
Low
SKILL.md:60-61SKILL.md:111SKILL.md:184SKILL.md:225SKILL.md:322-325
Network And Filesystem Detections Are Documentation Examples
The hardcoded URL findings are localhost, example API, and public documentation links. The filesystem findings are TypeScript method chaining and a relative import inside sample code, not hidden file access or path traversal.
The line context shows tutorial code and resource links only. There is no data exfiltration endpoint, downloader, or runtime filesystem operation.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Low
SKILL.md:248-257
Sample Mutation Omits Authentication Context
The full-stack example uses publicProcedure for a create mutation and does not show authorization checks. This is not malicious, but users could copy the sample into a production API without adding access control.
The sample clearly creates data through a public procedure. The surrounding document is a type-safety guide, so the omission is a documentation caveat rather than confirmed vulnerable deployed code.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:27SKILL.md:80SKILL.md:141SKILL.md:205SKILL.md:295
Static Command Execution Detections Are Markdown False Positives
The external command findings point to markdown code fences and TypeScript sample blocks, not runnable Ruby or shell backtick execution. The skill contains instructional examples, and no executable script file or command invocation was found.
The referenced lines are markdown fence boundaries for documentation samples. I found no executable file or instruction that runs these snippets automatically.
Low
SKILL.md:3SKILL.md:152SKILL.md:189-191SKILL.md:238SKILL.md:307-311
Weak Crypto And Reconnaissance Detections Are Terminology False Positives
The blocker findings map to general TypeScript, Prisma, or decorator terminology such as descriptions, descending sort order, and type utilities. No hashing algorithm, host discovery, scanning logic, or reconnaissance behavior was present.
The flagged lines are visible documentation and ordinary TypeScript syntax. Their semantic context does not match cryptography or reconnaissance.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable