📦

Audit History

genesis - 10 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v10 Latest	Jul 23, 2026, 10:55 AM	2 confirmed	4	No capability change
v9	Jul 7, 2026, 05:48 PM	1 confirmed	4	Contains scriptsEnv variables
v8	Jul 5, 2026, 05:07 AM	2 confirmed	6	No capability change
v7	Jun 28, 2026, 03:41 PM	3 confirmed	0	Filesystem accessEnv variables
v6	Jan 16, 2026, 06:46 PM	No confirmed findings	0	No capability change
v5	Jan 16, 2026, 06:46 PM	No confirmed findings	0	No capability change
v4	Jan 16, 2026, 06:46 PM	No confirmed findings	0	Network access
v3	Jan 10, 2026, 11:10 AM	No confirmed findings	0	No capability change
v2	Jan 10, 2026, 11:10 AM	No confirmed findings	0	No capability change
v1	Jan 10, 2026, 11:10 AM	No confirmed findings	0	Baseline

Audit version 10 Latest

Jul 23, 2026, 10:55 AM

Most alerts are false positives from documentation URLs, standard Claude paths, UTF-8 Chinese text, and Markdown syntax. Four shell blocks execute filesystem, package, script, and server commands. They use unquoted user values and explicitly bypass confirmation, creating command injection and supply-chain execution risks.

Files scanned

427

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:60-62 SKILL.md:88-90 SKILL.md:114-118 SKILL.md:149-154

Unquoted User Values in Shell Commands

Project names and target directories are inserted into shell commands without strict validation or quoting. Shell metacharacters could alter commands, overwrite unintended files, or execute additional processes.

The commands visibly interpolate target-directory and project-name placeholders without quoting. The checklist suggests a naming format but does not enforce or sanitize it.

High

SKILL.md:57-62 SKILL.md:85-90 SKILL.md:111-118 SKILL.md:146-154

Unconfirmed Dependency and Process Execution

The skill explicitly directs immediate execution without confirmation, then installs dependencies and starts scripts or servers. Package lifecycle hooks and copied scripts can execute unreviewed code.

Each workflow says to execute without confirmation and then invokes npm, uv, a local shell script, or Go tooling. These commands cause direct side effects.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:113-119 SKILL.md:148-155

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced Bash block copies files, edits package metadata, installs npm dependencies, and starts a development server. Although the detector mislabeled Markdown backticks, the block directs real process and filesystem execution.

Risk Factors

🌐 Network access (2)

README.md:29 README.md:35

📁 Filesystem access (12)

README.md:35 README.md:41 README.md:35 README.md:41 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149

⚙️ External commands (15)

SKILL.md:18 SKILL.md:19 SKILL.md:34-45 SKILL.md:45-59 SKILL.md:59-63 SKILL.md:63-87 SKILL.md:87-91 SKILL.md:91-113 SKILL.md:113-119 SKILL.md:119-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-148 SKILL.md:148-155

Audited by: codex

Audit version 9

Jul 7, 2026, 05:48 PM

Most static findings are false positives from Markdown links, fenced code blocks, inline command examples, and expected Claude skill installation paths. Confirmed risk remains in setup blocks that run package managers, local scripts, and broad file rewrite commands. No evidence found of obfuscated payloads or prompt-injection language.

Files scanned

427

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:57-63 SKILL.md:85-91 SKILL.md:111-119 SKILL.md:146-155

Automatic Command Execution Without Confirmation

The skill repeatedly says to execute setup commands without confirmation before package installs, local scripts, server starts, and broad file rewrites. This can run dependency lifecycle scripts or generated project code before user review.

The exact instruction appears before multiple bash blocks that install dependencies and run scripts. The risk is contextual because the problem is automatic execution without user approval.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:113-119 SKILL.md:148-155

Ruby/shell backtick execution · 4 occurrences

```bash

This bash block copies files, rewrites package metadata, installs dependencies, and starts npm scripts. Package installs and scripts can execute unreviewed code.

Risk Factors

🌐 Network access (2)

README.md:29 README.md:35

📁 Filesystem access (12)

README.md:35 README.md:41 README.md:35 README.md:41 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149

⚙️ External commands (15)

Audited by: codex

Audit version 8

Jul 5, 2026, 05:07 AM

Most static alerts are false positives from Go struct tags, Markdown code fences, local documentation URLs, and standard template configuration. Real concerns remain around direct shell-command execution with user-controlled placeholders and a Python config path that can print a password-bearing database URI.

Files scanned

6,348

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:55-63 SKILL.md:83-91 SKILL.md:109-119 SKILL.md:144-155

Unconfirmed Shell Commands With User-Controlled Placeholders

SKILL.md labels template-copy flows as direct execution without confirmation. The Bash blocks interpolate project names and target directories before running package managers and local servers.

The file explicitly says direct execution is allowed and shows concrete shell commands with placeholders. This is not hidden malware, but it is a clear command-injection and consent risk.

High

templates/backend-python/app/config.py:43-57 references/backend-python.md:98-113

Database URI Secret Exposure

The Python backend configuration can print settings.DataBaseURI when config.py is run as a script. That URI is built with POSTGRES_PASSWORD and can expose database credentials in terminal logs.

The URI builder includes POSTGRES_PASSWORD and the module prints the resulting DataBaseURI in both the template and reference guide. Exposure requires manual execution, so confidence is high but not absolute.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:113-119 SKILL.md:148-155

Ruby/shell backtick execution · 4 occurrences

```bash

The surrounding Bash block is labeled for direct execution and runs cp, sed, npm install, and npm run dev with user-supplied placeholders. That creates command execution and dependency-install risk if project names or paths are not validated.

Medium

templates/backend-python/local-run.sh:1

Unix shell invocation

#!/bin/bash

This template ships an executable Bash script that the skill invokes during Python backend setup. It uses fixed local commands, but it still sources environment variables and starts a development server.

Low

references/design-system.md:20

Hardcoded URL

npx shadcn@latest add https://tweakcn.com/r/themes/cyberpunk.json

The reference command fetches a shadcn theme from tweakcn.com. The URL is visible and developer-facing, but it is still an external network dependency during scaffold generation.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

High

references/backend-python.md:87 templates/backend-python/app/config.py:28

LLM role tokens injection · 2 occurrences

POSTGRES_USER: str

Force-confirmed blocker/high static finding; AI dismissal overridden.

Risk Factors

🌐 Network access (15)

README.md:29 README.md:35 references/backend-go.md:615 references/backend-go.md:616 references/backend-python.md:441 references/design-system.md:20 templates/backend-go/cmd/api/main.go:69 templates/backend-go/cmd/api/main.go:70 templates/backend-python/local-run.sh:7 templates/miniapp/babel.config.js:9 templates/miniapp/config/index.js:16 templates/miniapp/config/prod.js:15 templates/miniapp/config/prod.js:20 templates/miniapp/config/prod.js:26 templates/web-react/components.json:2

📁 Filesystem access (17)

README.md:35 README.md:41 README.md:35 README.md:41 references/taro-miniapp.md:91 references/taro-miniapp.md:91 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149 SKILL.md:60 SKILL.md:88 SKILL.md:114 SKILL.md:149 templates/miniapp/config/index.js:55 templates/miniapp/config/index.js:55 templates/miniapp/config/prod.js:30

⚡ Contains scripts (25)

references/backend-go.md:144-149 references/backend-go.md:236-243 references/backend-go.md:301-305 references/backend-go.md:372-374 references/backend-go.md:399-404 references/backend-go.md:434-438 references/backend-go.md:466-470 references/backend-go.md:496-500 references/backend-go.md:527-534 references/backend-go.md:584-592 references/backend-python.md:148 templates/backend-go/cmd/api/main.go:10-23 templates/backend-go/go.mod:5-6 templates/backend-go/go.mod:15-16 templates/backend-go/internal/config/config.go:10-17 templates/backend-go/internal/dto/base_dto.go:10-14 templates/backend-go/internal/handler/user_handler.go:10-14 templates/backend-go/internal/middleware/error_handler.go:10-16 templates/backend-go/internal/router/router.go:10-16 templates/backend-go/internal/service/user_service.go:10-13 templates/backend-go/magefile.go:13-20 templates/backend-go/pkg/base/handler.go:10-15 templates/backend-go/pkg/database/database.go:10-19 templates/backend-go/pkg/response/response.go:10-13 templates/backend-python/app/db/session.py:53

⚙️ External commands (71)

🔑 Env variables (5)

references/backend-python.md:15 templates/backend-go/internal/config/config.go:116 templates/backend-python/pyproject.toml:12 templates/miniapp/config/index.js:110 templates/miniapp/config/index.js:110

Audited by: codex

Audit version 7

Jun 28, 2026, 03:41 PM

Static analysis reported many high-risk patterns, but manual review found most were false positives from markdown examples, CSS color tokens, Go checksum data, fixed build paths, and SQLModel session.exec calls. The skill is still medium risk because it guides agents to copy files, run package managers and dev servers, read environment configuration, and generate networked backend templates. Publish with a warning to review commands and dependencies before execution.

Files scanned

6,346

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

SKILL.md:59-62 SKILL.md:87-90 SKILL.md:113-118 SKILL.md:148-154

Project Initialization Runs Shell Commands

The skill instructs agents to copy template directories, edit files with sed, install dependencies, and start development servers. These are legitimate scaffolding actions, but user-supplied project names and target directories should be validated before command execution.

The command sequences are explicitly present in the skill instructions and include placeholders for user-controlled paths and names. The intent is project scaffolding, so the risk is operational rather than clearly malicious.

Medium

templates/backend-python/app/config.py:24-35 templates/backend-python/local-run.sh:3-7 templates/backend-go/internal/config/config.go:112-118

Template Reads Environment and Database Secrets

The Python and Go backend templates load database settings from environment files or environment variables, including database passwords. This is normal backend configuration, but generated projects must avoid logging or committing these secrets.

The files directly read .env.dev, .env, DB_HOST, and DB_PASSWORD. This supports the advertised backend templates, but it is real secret-handling behavior that users should review.

Medium

templates/backend-python/app/main.py:60-66

Permissive CORS in FastAPI Template

The FastAPI template allows all origins, methods, and headers while also allowing credentials. This can be unsafe if copied into production without narrowing allowed origins.

The CORS settings are explicit and combine allow_origins=["*"] with allow_credentials=True. This is a concrete web security concern in generated backend projects.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

references/backend-python.md:143-149 templates/backend-python/app/db/session.py:48-54 references/taro-miniapp.md:89-92 templates/miniapp/src/app.css:3-6 templates/backend-go/go.sum:1-8

Most Static Findings Are Benign Template or Documentation Patterns

Several flagged patterns are false positives: SQLModel session.exec is not Python exec, Taro path.resolve uses a fixed source path, CSS hexadecimal color values are not cryptographic algorithms, and Go checksum entries are expected dependency metadata.

Manual review of representative locations confirms these patterns are framework methods, fixed build configuration, styling tokens, or package checksums. They do not show malicious behavior by themselves.

Low

templates/backend-go/cmd/api/main.go:68-70

Hardcoded Local Development URLs

The Go template logs localhost service and health-check URLs. These are local development endpoints, not evidence of data exfiltration.

The URLs are derived from the configured local server port and are only printed to logs for developer convenience. No external network destination is contacted at these lines.

Risk Factors

⚙️ External commands (7)

SKILL.md:59-62 SKILL.md:87-90 SKILL.md:113-118 SKILL.md:148-154 templates/backend-python/local-run.sh:1-7 templates/backend-go/magefile.go:26-29 templates/backend-go/magefile.go:56-62

🌐 Network access (3)

templates/backend-go/cmd/api/main.go:68-70 templates/backend-python/app/main.py:60-66 references/taro-miniapp.md:113

📁 Filesystem access (5)

SKILL.md:59-60 SKILL.md:87-88 SKILL.md:113-114 SKILL.md:148-149 templates/miniapp/config/index.js:53-56

⚡ Contains scripts (4)

templates/backend-go/magefile.go:26-29 templates/backend-go/magefile.go:35-50 templates/backend-python/local-run.sh:1-7 templates/miniapp/config/index.js:17-18

🔑 Env variables (5)

templates/backend-python/app/config.py:34-35 templates/backend-python/local-run.sh:3-7 templates/backend-go/internal/config/config.go:30-34 templates/backend-go/internal/config/config.go:112-118 templates/miniapp/config/index.js:110-115

Detected Patterns

External Command WorkflowEnvironment File Loading

Audited by: codex

Audit version 6

Jan 16, 2026, 06:46 PM

Legitimate project scaffolding skill with standard development tools. Shell commands and script execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected. Static findings are false positives from pattern matching limitations on documentation and configuration files.

Files scanned

7,058

Lines analyzed

Review items

False positives ignored

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

README.md:29 references/backend-go.md:24

Hardcoded URL references in documentation

Risk Factors

⚙️ External commands (4)

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:148-155 README.md:28-30

⚡ Contains scripts (1)

templates/backend-python/local-run.sh:1-7

🌐 Network access (2)

README.md:29 references/backend-go.md:24

Audited by: claude

Audit version 5

Jan 16, 2026, 06:46 PM

Files scanned

7,058

Lines analyzed

Review items

False positives ignored

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

README.md:29 references/backend-go.md:24

Hardcoded URL references in documentation

Risk Factors

⚙️ External commands (4)

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:148-155 README.md:28-30

⚡ Contains scripts (1)

templates/backend-python/local-run.sh:1-7

🌐 Network access (2)

README.md:29 references/backend-go.md:24

Audited by: claude

Audit version 4

Jan 16, 2026, 06:46 PM

Files scanned

7,058

Lines analyzed

Review items

False positives ignored

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

undefined:undefined undefined:undefined

Hardcoded URL references in documentation

Risk Factors

⚙️ External commands (4)

SKILL.md:59-63 SKILL.md:87-91 SKILL.md:148-155 README.md:28-30

⚡ Contains scripts (1)

templates/backend-python/local-run.sh:1-7

🌐 Network access (2)

README.md:29 references/backend-go.md:24

Audited by: claude

Audit version 3

Jan 10, 2026, 11:10 AM

Legitimate project scaffolding skill with standard development tools. Shell scripts and command execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected.

100

Files scanned

30,341

Lines analyzed

Review items

False positives ignored