Audit History
git-workflow - 10 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v10 Latest | Jul 23, 2026, 07:30 AM | No confirmed findings | 0 | No capability change |
| v9 | Jul 7, 2026, 11:07 PM | No confirmed findings | 0 | No capability change |
| v8 | Jul 5, 2026, 02:49 AM | No confirmed findings | 0 | No capability change |
| v7 | Jun 28, 2026, 12:13 PM | 1 confirmed | 0 | External commands |
| v6 | Jan 21, 2026, 04:39 PM | No confirmed findings | 0 | External commands |
| v5 | Jan 16, 2026, 05:26 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 05:26 PM | No confirmed findings | 0 | External commands |
| v3 | Jan 10, 2026, 10:37 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:37 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:37 AM | No confirmed findings | 0 | Baseline |
Jul 23, 2026, 07:30 AM
All seven static alerts are false positives caused by Markdown backticks and fenced examples in SKILL.md. The fixed local quality-check commands contain no dynamic input, network access, or malicious intent.
Risk Factors
⚙️ External commands (7)
Jul 7, 2026, 11:07 PM
The static findings are false positives caused by Markdown backticks and fenced examples in SKILL.md. The only actual shell commands shown are local pre-commit checks, with no evidence of credential exfiltration, network access, prompt injection, or unsafe command construction.
Risk Factors
⚙️ External commands (7)
Jul 5, 2026, 02:49 AM
The static findings are false positives caused by Markdown inline code and fenced examples, not Ruby backtick execution. The referenced commands are ordinary Git workflow checklist examples, with no evidence of command injection, exfiltration, or prompt injection.
Risk Factors
⚙️ External commands (7)
Jun 28, 2026, 12:13 PM
Static analysis reported Markdown backticks and a weak-crypto pattern, but most hits are false positives from prose, code fences, and placeholder text. The skill does include pre-commit shell commands, including npm scripts, which are legitimate but should be treated as external command execution in untrusted repositories.
Confirmed security concerns (1)
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (1)
Detected Patterns
Jan 21, 2026, 04:39 PM
This skill is a pure documentation resource teaching Git workflow best practices. All static findings are false positives from pattern matching on instructional markdown content. The skill contains no executable code, no network requests, and no security risks.
Jan 16, 2026, 05:26 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
Risk Factors
⚙️ External commands (7)
Detected Patterns
Jan 16, 2026, 05:26 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
Risk Factors
⚙️ External commands (7)
Detected Patterns
Jan 10, 2026, 10:37 AM
Pure prompt-based documentation skill with no executable code. Contains only Git best practices guidance and workflow instructions for AI behavior.
Jan 10, 2026, 10:37 AM
Pure prompt-based documentation skill with no executable code. Contains only Git best practices guidance and workflow instructions for AI behavior.
Jan 10, 2026, 10:37 AM
Pure prompt-based documentation skill with no executable code. Contains only Git best practices guidance and workflow instructions for AI behavior.