Versioned security assessment

Report ID: SA-197B0030

6/29/2026, 6:48:07 PM

generating-sorbet-inline security assessment v6

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: generating-sorbet-inline
Version: v6
Maintainer: DmitryPogrebnoy
Source: github.com/DmitryPogrebnoy/ruby-agent-skills/tree/main/plugins/ruby-type-signature-skills/skills/generating-sorbet-inline
Coverage: 67 Files scanned · 5,038 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis produced many high and critical alerts, but most are false positives from Sorbet signature syntax, Markdown backticks, documentation URLs, and reference examples. No prompt injection, credential exfiltration, or malicious network behavior was found. The remaining risk is moderate because the skill asks the agent to edit Ruby files and validate with an external Sorbet command.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

67 Files scanned · 5,038 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 1 evidence location

Capability review items (3)

Medium

SKILL.md:135-145

External Sorbet Validation Command

The skill instructs the agent to run `srb tc` or `bundle exec srb tc` to validate generated signatures. This is a legitimate Ruby typing workflow, but it invokes project tooling and should be performed only with user awareness in untrusted repositories.

The command guidance is explicit in the skill instructions. The command is not malicious by itself, but it is real external command execution in the target project context.

Medium

reference/sorbet_examples/packwerk/packwerk/package_todo.rb:89-91 reference/sorbet_examples/packwerk/packwerk/cache.rb:102

Reference Examples Contain Executable File Operations

The Packwerk reference examples include file writes and cache writes. These files appear to be examples for type-signature generation, not invoked by the skill, but they demonstrate filesystem-changing patterns that require review if copied into generated code.

The file operations are present in reference code, but there is no evidence that the skill executes these files. The risk is contextual and depends on whether the examples influence generated code.

Low

SKILL.md:16-23 reference/syntax.md:27-31 reference/sorbet_examples/packwerk/packwerk/package_todo.rb:65-66

Backtick Execution Alerts Are Markdown and Ruby Comments

Most external-command findings come from Markdown code fences, inline backticks, or Ruby comments that describe commands. The active command instruction is tracked separately as a medium finding.

Manual inspection shows these alerts are not Ruby shell backtick execution sites. They are instructional text, Markdown fences, or comments.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium

reference/sorbet_examples/packwerk/packwerk/extension_loader.rb:14-18 reference/sorbet_examples/packwerk/packwerk/rails_load_paths.rb:51-58

Reference Examples Include Dynamic Require Patterns

Reference code loads Ruby files based on configuration or application paths. This is normal for Packwerk examples, but dynamic require behavior can execute local Ruby code if reused without validation.

The dynamic require calls are clear, but they are in reference examples rather than the active skill instructions. This lowers confidence that they represent a direct marketplace risk.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)

Low

SKILL.md:3 reference/syntax.md:10-21 reference/sorbet_examples/packwerk/packwerk/cache.rb:113-117

Weak Cryptography Alerts Are Mostly Sorbet Syntax False Positives

Many weak-cryptography findings point to Sorbet words such as `sig`, `signature`, and `T::Hash`, not cryptographic APIs. The only confirmed MD5 usage is a reference cache digest, not password storage, signing, or security-sensitive hashing.

Manual review shows the highlighted terms are type-signature documentation, and the MD5 call is used for cache keys. No evidence of credential hashing or security-sensitive cryptography was found.

Low

SKILL.md:159 reference/syntax.md:3 reference/sorbet_examples/packwerk/packwerk/commands/init_command.rb:28-34

Network Alerts Are Documentation Links, Not Exfiltration

The network findings are hardcoded documentation URLs and source links in Markdown or example output. No evidence found of HTTP requests, telemetry, credential upload, or hidden remote control behavior in the skill instructions.

The reviewed locations contain URLs in documentation or user-facing messages. I did not find evidence that these URLs are fetched or that data is sent to them.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable