Audit History
conventions - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | Jul 6, 2026, 07:58 AM | No confirmed findings | 0 | No capability change |
| v7 | Jul 6, 2026, 07:58 AM | No confirmed findings | 0 | No capability change |
| v6 | Jun 28, 2026, 11:39 PM | No confirmed findings | 0 | No capability change |
| v5 | Jan 16, 2026, 10:06 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 10:06 PM | No confirmed findings | 0 | No capability change |
| v3 | Jan 10, 2026, 12:29 PM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 12:29 PM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 12:29 PM | No confirmed findings | 0 | Baseline |
Jul 6, 2026, 07:58 AM
Static analysis reported no suspicious patterns in the single prompt file. Manual review found a read-only coding conventions skill with no executable code, network behavior, secret handling, or prompt-injection attempt.
Jul 6, 2026, 07:58 AM
Static analysis reported no suspicious patterns in the single prompt file. Manual review found a read-only coding conventions skill with no executable code, network behavior, secret handling, or prompt-injection attempt.
Jun 28, 2026, 11:39 PM
Static analysis reported two high severity weak cryptographic algorithm matches at SKILL.md lines 3 and 8. Both are false positives caused by ordinary descriptions of coding conventions, with no cryptographic implementation or unsafe behavior found.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Jan 16, 2026, 10:06 PM
This is a prompt-based knowledge skill with no executable code. It only defines metadata for loading coding conventions from conventions.json. The static scanner produced false positives by misidentifying metadata fields (URLs, hashes, skill name) as security threats. No network access, no file system operations beyond reading convention files, and no external commands.
Jan 16, 2026, 10:06 PM
This is a prompt-based knowledge skill with no executable code. It only defines metadata for loading coding conventions from conventions.json. The static scanner produced false positives by misidentifying metadata fields (URLs, hashes, skill name) as security threats. No network access, no file system operations beyond reading convention files, and no external commands.
Jan 10, 2026, 12:29 PM
This is a prompt-based knowledge skill that only defines metadata for loading coding conventions. No executable code, no network access, no file system access beyond reading convention files, and no external commands.
Jan 10, 2026, 12:29 PM
This is a prompt-based knowledge skill that only defines metadata for loading coding conventions. No executable code, no network access, no file system access beyond reading convention files, and no external commands.
Jan 10, 2026, 12:29 PM
This is a prompt-based knowledge skill that only defines metadata for loading coding conventions. No executable code, no network access, no file system access beyond reading convention files, and no external commands.