Versioned security assessment

Report ID: SA-91144456

6/28/2026, 3:41:47 PM

genesis security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
genesis
Version
v7
Maintainer
BellyBook
Source
github.com/BellyBook/genesis/tree/main/
Coverage
75 Files scanned · 6,346 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but manual review found most were false positives from markdown examples, CSS color tokens, Go checksum data, fixed build paths, and SQLModel session.exec calls. The skill is still medium risk because it guides agents to copy files, run package managers and dev servers, read environment configuration, and generate networked backend templates. Publish with a warning to review commands and dependencies before execution.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

75 Files scanned · 6,346 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Observed in 5 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 7 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:59-62SKILL.md:87-90SKILL.md:113-118SKILL.md:148-154
Project Initialization Runs Shell Commands
The skill instructs agents to copy template directories, edit files with sed, install dependencies, and start development servers. These are legitimate scaffolding actions, but user-supplied project names and target directories should be validated before command execution.
The command sequences are explicitly present in the skill instructions and include placeholders for user-controlled paths and names. The intent is project scaffolding, so the risk is operational rather than clearly malicious.
RISK-002 Medium
templates/backend-python/app/config.py:24-35templates/backend-python/local-run.sh:3-7templates/backend-go/internal/config/config.go:112-118
Template Reads Environment and Database Secrets
The Python and Go backend templates load database settings from environment files or environment variables, including database passwords. This is normal backend configuration, but generated projects must avoid logging or committing these secrets.
The files directly read .env.dev, .env, DB_HOST, and DB_PASSWORD. This supports the advertised backend templates, but it is real secret-handling behavior that users should review.
RISK-003 Medium
templates/backend-python/app/main.py:60-66
Permissive CORS in FastAPI Template
The FastAPI template allows all origins, methods, and headers while also allowing credentials. This can be unsafe if copied into production without narrowing allowed origins.
The CORS settings are explicit and combine allow_origins=["*"] with allow_credentials=True. This is a concrete web security concern in generated backend projects.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
references/backend-python.md:143-149templates/backend-python/app/db/session.py:48-54references/taro-miniapp.md:89-92templates/miniapp/src/app.css:3-6templates/backend-go/go.sum:1-8
Most Static Findings Are Benign Template or Documentation Patterns
Several flagged patterns are false positives: SQLModel session.exec is not Python exec, Taro path.resolve uses a fixed source path, CSS hexadecimal color values are not cryptographic algorithms, and Go checksum entries are expected dependency metadata.
Manual review of representative locations confirms these patterns are framework methods, fixed build configuration, styling tokens, or package checksums. They do not show malicious behavior by themselves.
Low
templates/backend-go/cmd/api/main.go:68-70
Hardcoded Local Development URLs
The Go template logs localhost service and health-check URLs. These are local development endpoints, not evidence of data exfiltration.
The URLs are derived from the configured local server port and are only printed to logs for developer convenience. No external network destination is contacted at these lines.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable