Versioned security assessment

Report ID: SA-3AC5D546

6/29/2026, 3:06:56 AM

scribe-mcp-usage security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
scribe-mcp-usage
Version
v7
Maintainer
CortaLabs
Source
github.com/CortaLabs/scribe_mcp/tree/master/.codex/skills/scribe-mcp-usage
Coverage
1 Files scanned · 572 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static command, filesystem, and environment hits are mostly false positives caused by Markdown examples, placeholder paths, and variable names. The substantive risk is prompt-style authority language that tells agents to treat the skill as non-negotiable policy and to log broad work details. No evidence found of bundled executable code, network exfiltration, or confirmed malicious intent.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 572 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:26-53SKILL.md:62-74SKILL.md:136
Prompt Injection Attempt Detected
The skill uses non-negotiable commandment language, claims broad MCP tool access, and requires agents to log every action. This can override platform policy, change task workflow, and cause sensitive project details to be written into logs.
The text explicitly directs agent behavior with absolute language and broad logging requirements. I did not find exfiltration or malware, so confidence is high for prompt-control risk but not critical malicious intent.
RISK-002 Medium
SKILL.md:99-136SKILL.md:558-563
Overbroad Audit Logging Instructions
The skill repeatedly instructs agents to log investigations, decisions, code changes, test results, and missed steps. This is useful for audit trails but can capture private user context if applied without filtering.
The logging scope is directly stated and repeated in the skill. The risk depends on runtime data handled by users, so it is moderate rather than confirmed data exposure.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:84-94SKILL.md:518-540
False Positive: Markdown Command Examples
The external command detections are Markdown examples and inline tool signatures, not executable Ruby or shell code shipped by the skill. They should still be reviewed before users copy commands into a terminal.
The flagged text appears inside fenced or inline Markdown documentation. No executable source file or automatic command invocation was found.
Low
SKILL.md:211-222SKILL.md:504-510
False Positive: Placeholder Path Examples
The path traversal detections are placeholder paths in documented responses, such as abbreviated absolute paths. No file read or write code uses these paths in the skill.
The evidence is response examples in Markdown and uses ellipses as placeholders. I found no code that resolves user-controlled traversal paths.
Low
SKILL.md:89-94
False Positive: Environment Variable Mention
The environment access finding is a documented paid-test gate naming an API key variable. The skill does not read the variable or transmit secret values.
The variable appears as explanatory text for skipping paid tests by default. No executable access to environment values was found.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable