Audit History

Review confirmed three medium-severity arbitrary file overwrite paths and one medium-severity import-hijacking risk. The other 182 static findings are false positives from EC numbers, Markdown formatting, ordinary imports, credential setup documentation, and official URLs. No prompt injection, credential exfiltration, obfuscated execution, or malicious intent was found.

Most static alerts were false positives from EC numbers, Markdown code fences, normal imports, and public documentation URLs. Confirmed issues are limited to BRENDA credential handling through .env guidance and local export or report writes to caller-supplied filenames. No prompt-injection text or hidden malicious intent was found in the scanned files.

AI review found no prompt injection, exfiltration intent, or obfuscated executable payload. Most alerts are false positives from EC numbers, Markdown fences, documentation, and normal imports. The confirmed issue is local export and report writing to caller-provided filenames.

AI review found no prompt injection, exfiltration intent, or obfuscated executable payload. Most alerts are false positives from EC numbers, Markdown fences, documentation, and normal imports. The confirmed issue is local export and report writing to caller-provided filenames.

AI review did not confirm malicious intent or prompt injection in the reviewed files. Most static findings are false positives from Markdown code fences, EC numbers, chemical formulas, and SHA-256 documentation. The skill still has medium risk because it uses authenticated external BRENDA access, reads credentials from environment-style configuration, and writes user-selected export files.

Legitimate scientific research tool for accessing the BRENDA enzyme database via SOAP API. All static findings are false positives: markdown documentation backticks flagged as shell execution, EC numbers (enzyme classification) misidentified as IP addresses, SHA-256 password hashing is secure, and biochemistry cofactor names (NAD, NADH) flagged as C2 keywords are legitimate metabolite names. The skill only accesses environment variables for API credentials and makes documented SOAP calls to brenda-enzymes.org.

Legitimate scientific research tool for accessing the BRENDA enzyme database via SOAP API. All static findings are false positives: markdown documentation backticks flagged as shell execution, EC numbers (enzyme classification) misidentified as IP addresses, SHA-256 password hashing is secure, and biochemistry cofactor names (NAD, NADH) flagged as C2 keywords are legitimate metabolite names. The skill only accesses environment variables for API credentials and makes documented SOAP calls to brenda-enzymes.org.

Legitimate scientific research tool. Makes documented SOAP API calls to brenda-enzymes.org for enzyme data. Accesses environment variables for API credentials only. Standard Python data processing, parsing, visualization, and file export capabilities.

Legitimate scientific research tool. Makes documented SOAP API calls to brenda-enzymes.org for enzyme data. Accesses environment variables for API credentials only. Standard Python data processing, parsing, visualization, and file export capabilities.

Legitimate scientific research tool. Makes documented SOAP API calls to brenda-enzymes.org for enzyme data. Accesses environment variables for API credentials only. Standard Python data processing, parsing, visualization, and file export capabilities.