Versioned security assessment

Report ID: SA-02F077C1

7/5/2026, 7:31:28 AM

ai-architect-lite security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ai-architect-lite
Version
v8
Maintainer
Carl-312
Source
github.com/Carl-312/devlog-starter/tree/main/
Coverage
10 Files scanned · 749 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives caused by Markdown backticks, Chinese UTF-8 documentation, or security guidance text. No prompt injection, network behavior, secret access, or encoded binary content was found. The remaining concerns are path-scope enforcement in helper scripts and one instruction that can run an unbundled project-local Python entrypoint.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 749 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 22 evidence locations

Capability review items (1)
Medium
SKILL.md:16
Ruby/shell backtick execution
2. 检查 `PROJECT_ROOT/.ai_context/03_ACTIVE_TASK.md`;缺失则按 `references/lite-protocol.md` 模板创建或运行 `pytho
The skill instructs the agent to run a Python project-init entrypoint when context is missing. That script is not bundled here, so execution could run project-local code with filesystem side effects.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
scripts/plan_helper.py:26-28scripts/plan_helper.py:70-82scripts/append_log.py:33scripts/append_log.py:99-100
Path Scope Is Not Fully Enforced
The helper scripts accept --out and --root path parameters and resolve them, but they do not enforce that writes stay under the active project root. An agent following untrusted task text could write a plan or .ai_context file outside the intended repository.
The write paths are directly controlled by CLI parameters and no project-root containment check compares them to the current repository. The issue requires command execution with chosen arguments, so severity is medium rather than high.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Unbounded output paths in helper scripts
    Compare resolved output and root paths to the resolved project root before writing, and reject absolute paths outside that root.
  2. FIX-002
    Medium
    Unbundled project-init command can execute project-local code
    Remove the command, bundle the referenced script, or require explicit user confirmation before running project-local entrypoints.
  3. FIX-003
    Low
    Hidden context files may capture sensitive task notes
    Add clear .gitignore guidance for .ai_context and remind users not to store credentials or customer data in logs.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
02f077c174c5335e2f5d02ca15e77b70d9543e58
Content hash
1f62b23510599b4941527fdae6f7a4157b6ecb105a17e8e3200115f06b656213
Tree hash
a916ca14d4a08bf6e89706a4b010e12d705f5fe7b2fa004f36d0cc46ad40e9f1
Skill path
skills/carl-312/ai-architect-lite
Audit payload hash
86314864b93868380c07ca5019697e03

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable