📦

Audit History

parametric-scribe - 10 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v10 LatestJul 9, 2026, 12:14 PM 2 confirmed1No capability change
v9 Jul 9, 2026, 12:14 PM 2 confirmed1No capability change
v8 Jul 5, 2026, 08:03 AM No confirmed findings1No capability change
v7 Jul 5, 2026, 08:03 AM No confirmed findings1 Filesystem access
v6 Jun 29, 2026, 09:47 AM No confirmed findings1Filesystem access
v5 Jan 16, 2026, 11:56 PM No confirmed findings0No capability change
v4 Jan 16, 2026, 11:56 PM No confirmed findings0External commands
v3 Jan 10, 2026, 01:01 PM No confirmed findings0No capability change
v2 Jan 10, 2026, 01:01 PM No confirmed findings0No capability change
v1 Jan 10, 2026, 01:01 PM No confirmed findings0Baseline

Jul 9, 2026, 12:14 PM

Most static findings are Markdown backtick false positives, not Ruby or shell execution. One real external command risk remains because the replay workflow instructs git checkout, and two semantic risks involve prompt retention and replaying recipe-sourced prompts.

3
Files scanned
88
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
Untrusted Recipe Prompt Replay
The replay protocol reads original prompts from the recipe and executes adapted prompts. A tampered recipe file could steer the agent during replay.
The protocol directly reads recipe content and later executes adapted prompts from that history. The threat requires an untrusted or modified recipe file, so the confidence is moderate.
Low
Sensitive Prompt Retention
The recipe format stores the exact prompt used for each step. If prompts contain secrets or private data, docs/recipe.yaml can retain sensitive information.
The documented YAML entry includes a prompt field that records the exact prompt. The risk depends on user content, so confidence is high for retention behavior but lower for actual exposure.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
3. **Hard Reset:** `git checkout <Step X-1 SHA>` (Go back to the state *before* Step X).
Line 33 explicitly instructs the agent to run git checkout against a stored SHA. This external command can change repository state and should require clean-worktree checks and user confirmation.
Audited by: codex

Jul 9, 2026, 12:14 PM

Most static findings are Markdown backtick false positives, not Ruby or shell execution. One real external command risk remains because the replay workflow instructs git checkout, and two semantic risks involve prompt retention and replaying recipe-sourced prompts.

3
Files scanned
88
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
Untrusted Recipe Prompt Replay
The replay protocol reads original prompts from the recipe and executes adapted prompts. A tampered recipe file could steer the agent during replay.
The protocol directly reads recipe content and later executes adapted prompts from that history. The threat requires an untrusted or modified recipe file, so the confidence is moderate.
Low
Sensitive Prompt Retention
The recipe format stores the exact prompt used for each step. If prompts contain secrets or private data, docs/recipe.yaml can retain sensitive information.
The documented YAML entry includes a prompt field that records the exact prompt. The risk depends on user content, so confidence is high for retention behavior but lower for actual exposure.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
3. **Hard Reset:** `git checkout <Step X-1 SHA>` (Go back to the state *before* Step X).
Line 33 explicitly instructs the agent to run git checkout against a stored SHA. This external command can change repository state and should require clean-worktree checks and user confirmation.
Audited by: codex

Jul 5, 2026, 08:03 AM

Most static alerts are false positives caused by Markdown backticks around filenames and YAML examples. One medium-risk item remains: the replay protocol instructs the agent to run git checkout against a recipe SHA, which can change repository state. I found no prompt injection text or data exfiltration intent in the reviewed files.

3
Files scanned
88
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
3. **Hard Reset:** `git checkout <Step X-1 SHA>` (Go back to the state *before* Step X).
The replay protocol instructs the agent to run git checkout with a recipe SHA, which can change repository state. This is not Ruby backtick execution, but it is a real external command that needs confirmation and dirty-tree checks.
Audited by: codex

Jul 5, 2026, 08:03 AM

Most static alerts are false positives caused by Markdown backticks around filenames and YAML examples. One medium-risk item remains: the replay protocol instructs the agent to run git checkout against a recipe SHA, which can change repository state. I found no prompt injection text or data exfiltration intent in the reviewed files.

3
Files scanned
88
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
3. **Hard Reset:** `git checkout <Step X-1 SHA>` (Go back to the state *before* Step X).
The replay protocol instructs the agent to run git checkout with a recipe SHA, which can change repository state. This is not Ruby backtick execution, but it is a real external command that needs confirmation and dirty-tree checks.
Audited by: codex

Jun 29, 2026, 09:47 AM

Static analysis reported many command-execution and weak-cryptography matches, but most are false positives from Markdown backticks, YAML examples, and prose. One real concern remains: the replay workflow instructs the assistant to run a git checkout against a stored SHA, which can alter the working tree and should require user confirmation.

3
Files scanned
88
Lines analyzed
3
Review items
2
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Destructive Git Checkout Instruction
Replay mode instructs the assistant to run git checkout against a prior step SHA. This is a legitimate version-control workflow, but it can change the working tree and may discard uncommitted work if used without user confirmation.
The command is explicitly shown in the replay protocol, and its operational effect is clear. It is not evidence of malware, but it is a real destructive workflow risk.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Markdown Backtick Alerts Mostly False Positive
The static command-execution alerts mostly point to inline Markdown code, file names, or a fenced YAML recipe example. These are documentation patterns rather than executable code, except for the git checkout instruction tracked separately.
The cited lines are visible documentation or YAML examples, not executable source files. Manual review found no script body, shell wrapper, or hidden command runner.
Low
Weak Cryptography Alerts False Positive
The weak-cryptography alerts point to descriptive text, not a cryptographic algorithm or hash implementation. No evidence found of MD5, SHA-1, or other weak cryptographic use in the cited lines.
The referenced lines contain natural-language descriptions of the skill. There is no cryptographic API, algorithm name, or security-sensitive hash logic at those locations.

Risk Factors

⚙️ External commands (1)
📁 Filesystem access (4)

Detected Patterns

Version-Control State Change Command
Audited by: codex

Jan 16, 2026, 11:56 PM

This skill contains only documentation files with no executable code. All static findings are false positives: markdown code formatting (backticks) was misidentified as shell command execution, git SHA references were misidentified as weak cryptographic algorithms, and metadata fields were misidentified as C2 indicators and hardcoded URLs. The skill operates purely through documentation instructing AI assistants to maintain a YAML history file.

4
Files scanned
285
Lines analyzed
1
Review items
0
False positives ignored
Audited by: claude

Jan 16, 2026, 11:56 PM

This skill contains only documentation files with no executable code. All static findings are false positives: markdown code formatting (backticks) was misidentified as shell command execution, git SHA references were misidentified as weak cryptographic algorithms, and metadata fields were misidentified as C2 indicators and hardcoded URLs. The skill operates purely through documentation instructing AI assistants to maintain a YAML history file.

4
Files scanned
285
Lines analyzed
1
Review items
0
False positives ignored
Audited by: claude

Jan 10, 2026, 01:01 PM

This skill contains no executable code and poses no security risks. It operates purely through documentation that instructs AI assistants to maintain a YAML history file of coding tasks.

3
Files scanned
51
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 10, 2026, 01:01 PM

This skill contains no executable code and poses no security risks. It operates purely through documentation that instructs AI assistants to maintain a YAML history file of coding tasks.

3
Files scanned
51
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 10, 2026, 01:01 PM

This skill contains no executable code and poses no security risks. It operates purely through documentation that instructs AI assistants to maintain a YAML history file of coding tasks.

3
Files scanned
51
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude