Versioned security assessment

Report ID: SA-8C3E20BB

7/23/2026, 10:55:26 AM

genesis security assessment v10

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
genesis
Version
v10
Maintainer
BellyBook
Source
github.com/BellyBook/genesis/tree/main/
Coverage
3 Files scanned · 427 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most alerts are false positives from documentation URLs, standard Claude paths, UTF-8 Chinese text, and Markdown syntax. Four shell blocks execute filesystem, package, script, and server commands. They use unquoted user values and explicitly bypass confirmation, creating command injection and supply-chain execution risks.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 427 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 6 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 15 evidence locations

Capability review items (4)
Medium
SKILL.md:59-63
Ruby/shell backtick execution
```bash
The fenced Bash block copies files, edits package metadata, installs npm dependencies, and starts a development server. Although the detector mislabeled Markdown backticks, the block directs real process and filesystem execution.
Medium
SKILL.md:87-91
Ruby/shell backtick execution
```bash
The fenced Bash block copies and edits a project, resolves Python dependencies, and launches a local script. These commands create filesystem, dependency, and process side effects.
Medium
SKILL.md:113-119
Ruby/shell backtick execution
```bash
The fenced Bash block copies a Taro project, rewrites configuration, installs npm dependencies, and starts a WeChat development process. These are real external-command side effects.
Medium
SKILL.md:148-155
Ruby/shell backtick execution
```bash
The fenced Bash block copies a Go project, rewrites multiple files, resolves modules, and starts an API process. These commands have broad filesystem and process effects.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:60-62SKILL.md:88-90SKILL.md:114-118SKILL.md:149-154
Unquoted User Values in Shell Commands
Project names and target directories are inserted into shell commands without strict validation or quoting. Shell metacharacters could alter commands, overwrite unintended files, or execute additional processes.
The commands visibly interpolate target-directory and project-name placeholders without quoting. The checklist suggests a naming format but does not enforce or sanitize it.
RISK-002 High
SKILL.md:57-62SKILL.md:85-90SKILL.md:111-118SKILL.md:146-154
Unconfirmed Dependency and Process Execution
The skill explicitly directs immediate execution without confirmation, then installs dependencies and starts scripts or servers. Package lifecycle hooks and copied scripts can execute unreviewed code.
Each workflow says to execute without confirmation and then invokes npm, uv, a local shell script, or Go tooling. These commands cause direct side effects.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Shell commands interpolate project names and target directories without validation or quoting.
    Validate names against a strict lowercase-hyphen pattern and pass quoted paths through positional parameters or structured tool arguments.
  2. FIX-002
    High
    The workflow directs agents to install dependencies and start scripts or servers without confirmation.
    Show each command, explain its effects, and require explicit approval before copying files, installing packages, running scripts, or starting services.
  3. FIX-003
    Medium
    Referenced templates and reference documents are absent from the audited package.
    Include every referenced file, dependency manifest, and lockfile so reviewers can verify generated code and installation scripts.
  4. FIX-004
    Medium
    The sed examples require macOS or BSD command syntax.
    Use a portable project-renaming tool or provide tested commands for macOS, Linux, and Windows.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
8c3e20bba512c392d9b02ee748b18e0b09d4982c
Content hash
05d9d0736b829c2eeacf4b3667b3e5175f1a71c660226ed33d175674204502c7
Tree hash
8adea6d7288c9ffc3da9939175f8af85d9e5c7497173cdf70d431cd55d24cf9a
Skill path
skills/bellybook/genesis
Audit payload hash
417e24d18ee07b89c0ab7f8637d16e41

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active