📦
Audit History
vet - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 5, 2026, 03:06 PM | 3 confirmed | 19 | No capability change |
| v3 | Jul 5, 2026, 03:06 PM | 3 confirmed | 19 | No capability change |
| v2 | Jun 30, 2026, 04:30 AM | No confirmed findings | 4 | External commandsFilesystem access |
| v1 | Feb 22, 2026, 05:14 AM | No confirmed findings | 0 | Baseline |
Audit version 4 Latest
Jul 5, 2026, 03:06 PM
The skill intentionally runs local vet commands and optional history-loader scripts that read assistant conversation files under hidden home directories. Many markdown backtick detections are false positives, but the documented command execution and transcript access are real privacy and execution risks. No prompt injection language or direct network exfiltration code was found in the reviewed files.
4
Files scanned
269
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Sensitive Conversation History Exposure
The skill is designed to review conversation history along with git diffs. The documented history loaders and session discovery steps can expose prompts, assistant replies, code, file paths, and secrets to vet processing.
The documentation explicitly says vet reviews conversation history and gives loader commands for OpenCode, Codex, and Claude Code. The listed hidden session paths are known places where sensitive transcripts are stored.
Medium
Autonomous Tool Execution Pressure
The skill tells agents to run vet immediately after each logical unit of code changes and not wait to be asked. This can lead to unrequested command execution, especially when combined with history-loader guidance.
The instruction is repeated in the front matter and main text. It is not malicious by itself, but it creates consent risk for commands that inspect local data.
Medium
Unvalidated Session Identifier Used in File Paths
The OpenCode exporter uses the supplied session id to build a filesystem path before validating the expected ses_ format. A malformed value could cause unintended directory traversal behavior in local file reads.
The path is directly derived from user input and message ids without visible normalization or validation. Exploitability is limited because the script expects OpenCode-shaped local JSON, so confidence is medium.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode command runs a Python script from a hidden home directory path. It is part of the intended setup, but hidden home access is a real privacy and integrity risk.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex command references a hidden ~/.codex skill path and takes a session file. This can expose local assistant conversation history.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code command references a hidden ~/.claude skill path and a session file. This is intended but still sensitive hidden-home access.
High
Hidden file in home directory
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The grep command searches ~/.local/share/opencode storage for conversation text. That directory can contain sensitive local session history.
High
Hidden file in home directory
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance directs users to inspect ~/.codex/sessions for the correct conversation. Codex session files can contain prompts, code, and secrets.
High
Hidden file in home directory
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance directs users to inspect ~/.claude/projects for conversation files. Those hidden files may contain sensitive project and prompt data.
Medium
Ruby/shell backtick execution · 5 occurrences
```bash
The fenced block instructs users to run pip, uv, and vet commands. Installing and executing a package is a real external command risk, even though the markdown fence itself is benign.
Medium
Ruby/shell backtick execution
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The instruction uses grep over OpenCode storage to locate a session. This is external command execution against local application data.
Medium
Ruby/shell backtick execution
- `--agentic`: Mode that routes analysis through the locally installed Claude Code or Codex CLI inst
The --agentic option states that vet routes analysis through local Claude Code or Codex CLIs. That mode can invoke external local tools, although only when selected.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode example executes a loader from a hidden home directory. This hidden-file access is expected for the skill but should be consent-gated.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex example uses a hidden ~/.codex path and a session file. Access to that data is privacy-sensitive even when used for code review.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code example uses a hidden ~/.claude path and session file. The access is intentional but sensitive.
Medium
Hidden file access
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The command searches hidden OpenCode storage for a unique message. That is direct access to local conversation data.
Medium
Hidden file access
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance instructs locating files under ~/.codex/sessions. This is hidden-file access to assistant transcripts.
Medium
Hidden file access
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance instructs locating files under ~/.claude/projects. This is hidden-file access to assistant transcripts.
Risk Factors
⚙️ External commands (22)
SKILL.md:16-25 SKILL.md:25-32 SKILL.md:32-34 SKILL.md:34-37 SKILL.md:37-39 SKILL.md:39-42 SKILL.md:42-44 SKILL.md:44-47 SKILL.md:47-49 SKILL.md:49-53 SKILL.md:53 SKILL.md:55-57 SKILL.md:57-58 SKILL.md:58-60 SKILL.md:60-62 SKILL.md:62 SKILL.md:72-73 SKILL.md:73-74 SKILL.md:74-75 SKILL.md:75 SKILL.md:76-77 SKILL.md:77-78
📁 Filesystem access (12)
Audited by: codex
Jul 5, 2026, 03:06 PM
The skill intentionally runs local vet commands and optional history-loader scripts that read assistant conversation files under hidden home directories. Many markdown backtick detections are false positives, but the documented command execution and transcript access are real privacy and execution risks. No prompt injection language or direct network exfiltration code was found in the reviewed files.
4
Files scanned
269
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Sensitive Conversation History Exposure
The skill is designed to review conversation history along with git diffs. The documented history loaders and session discovery steps can expose prompts, assistant replies, code, file paths, and secrets to vet processing.
The documentation explicitly says vet reviews conversation history and gives loader commands for OpenCode, Codex, and Claude Code. The listed hidden session paths are known places where sensitive transcripts are stored.
Medium
Autonomous Tool Execution Pressure
The skill tells agents to run vet immediately after each logical unit of code changes and not wait to be asked. This can lead to unrequested command execution, especially when combined with history-loader guidance.
The instruction is repeated in the front matter and main text. It is not malicious by itself, but it creates consent risk for commands that inspect local data.
Medium
Unvalidated Session Identifier Used in File Paths
The OpenCode exporter uses the supplied session id to build a filesystem path before validating the expected ses_ format. A malformed value could cause unintended directory traversal behavior in local file reads.
The path is directly derived from user input and message ids without visible normalization or validation. Exploitability is limited because the script expects OpenCode-shaped local JSON, so confidence is medium.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode command runs a Python script from a hidden home directory path. It is part of the intended setup, but hidden home access is a real privacy and integrity risk.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex command references a hidden ~/.codex skill path and takes a session file. This can expose local assistant conversation history.
High
Hidden file in home directory
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code command references a hidden ~/.claude skill path and a session file. This is intended but still sensitive hidden-home access.
High
Hidden file in home directory
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The grep command searches ~/.local/share/opencode storage for conversation text. That directory can contain sensitive local session history.
High
Hidden file in home directory
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance directs users to inspect ~/.codex/sessions for the correct conversation. Codex session files can contain prompts, code, and secrets.
High
Hidden file in home directory
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance directs users to inspect ~/.claude/projects for conversation files. Those hidden files may contain sensitive project and prompt data.
Medium
Ruby/shell backtick execution · 5 occurrences
```bash
The fenced block instructs users to run pip, uv, and vet commands. Installing and executing a package is a real external command risk, even though the markdown fence itself is benign.
Medium
Ruby/shell backtick execution
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The instruction uses grep over OpenCode storage to locate a session. This is external command execution against local application data.
Medium
Ruby/shell backtick execution
- `--agentic`: Mode that routes analysis through the locally installed Claude Code or Codex CLI inst
The --agentic option states that vet routes analysis through local Claude Code or Codex CLIs. That mode can invoke external local tools, although only when selected.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode example executes a loader from a hidden home directory. This hidden-file access is expected for the skill but should be consent-gated.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex example uses a hidden ~/.codex path and a session file. Access to that data is privacy-sensitive even when used for code review.
Medium
Hidden file access
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code example uses a hidden ~/.claude path and session file. The access is intentional but sensitive.
Medium
Hidden file access
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The command searches hidden OpenCode storage for a unique message. That is direct access to local conversation data.
Medium
Hidden file access
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance instructs locating files under ~/.codex/sessions. This is hidden-file access to assistant transcripts.
Medium
Hidden file access
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance instructs locating files under ~/.claude/projects. This is hidden-file access to assistant transcripts.
Risk Factors
⚙️ External commands (22)
SKILL.md:16-25 SKILL.md:25-32 SKILL.md:32-34 SKILL.md:34-37 SKILL.md:37-39 SKILL.md:39-42 SKILL.md:42-44 SKILL.md:44-47 SKILL.md:47-49 SKILL.md:49-53 SKILL.md:53 SKILL.md:55-57 SKILL.md:57-58 SKILL.md:58-60 SKILL.md:60-62 SKILL.md:62 SKILL.md:72-73 SKILL.md:73-74 SKILL.md:74-75 SKILL.md:75 SKILL.md:76-77 SKILL.md:77-78
📁 Filesystem access (12)
Audited by: codex
Jun 30, 2026, 04:30 AM
Static weak-cryptography findings are false positives; the cited lines contain descriptions, command examples, or argument parsing, not cryptographic operations. The confirmed risks are intentional external command execution and reading local assistant session history from hidden directories, which are legitimate for this skill but require user awareness.
4
Files scanned
269
Lines analyzed
6
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
External Review Tool Execution
The skill instructs agents to install and run the verify-everything vet command, including history-loader commands. This is expected behavior for the skill, but it executes local commands and depends on an external package.
The command examples are explicit and central to the skill workflow. The risk is medium because the commands are documented review operations, not hidden or obfuscated execution.
Medium
SKILL.md:33-43SKILL.md:53-62scripts/export_claude_code_session.py:11-15scripts/export_codex_session.py:11-15scripts/export_opencode_session.py:11-40
Local Conversation History Access
The skill directs agents to read Claude Code, Codex, and OpenCode session files from hidden local directories and pass the extracted history to vet. This can expose sensitive prompts, code, or credentials contained in prior conversation history.
The file paths and loader scripts directly read local assistant history files. The behavior is intentional and useful, but the privacy impact is clear.
Low
Unvalidated OpenCode Session Identifier
The OpenCode export script uses the provided session identifier to build local paths without validating that it matches the expected ses_ format. This could read unexpected local JSON files if an untrusted session identifier is supplied.
The script does not validate the session-id value before path construction. Exploitability appears limited because the script reads local JSON files and requires local command invocation.
Low
Local Session Discovery Commands
The documentation recommends grep-based discovery of session files in OpenCode storage. This is local reconnaissance for a stated workflow, but it can reveal where conversation records are stored.
The local discovery behavior is explicitly documented and has a legitimate purpose. It remains a low privacy concern because it searches assistant storage directories.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
scripts/export_claude_code_session.py:7scripts/export_codex_session.py:7scripts/export_opencode_session.py:7SKILL.md:3-10SKILL.md:60-62
Static Weak-Cryptography Findings Dismissed
The reported weak-cryptography locations do not contain cryptographic operations. They are descriptions, argument parser declarations, or documentation text, so these scanner hits are false positives.
Manual review found no hashing, encryption, cipher selection, or cryptographic API use at the cited locations. The static pattern appears to match unrelated text.
Risk Factors
⚙️ External commands (3)
Detected Patterns
History Loader Executes Local Python ScriptsAssistant History Is Printed for Downstream Processing
Audited by: codex
Feb 22, 2026, 05:14 AM
This is a legitimate code review tool that analyzes AI assistant session history and git diffs. The static scanner flagged 54 potential issues, but all are false positives. The 'weak cryptographic algorithm' alerts are triggered by argparse (command-line parsing), not crypto code. 'Shell backtick' alerts are markdown code blocks showing example commands, not actual execution. 'Hidden file' and 'system reconnaissance' alerts are legitimate file path accesses to session storage required for the tool to function.
4
Files scanned
269
Lines analyzed
0
Review items
4
False positives ignored
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
High
scripts/export_claude_code_session.py:7scripts/export_codex_session.py:7scripts/export_opencode_session.py:7
False Positive: Weak Cryptographic Algorithm
Scanner flagged 'argparse' module as weak crypto. This is a command-line argument parsing library, not a cryptographic module. No cryptographic operations present.
argparse is a standard Python library for command-line parsing, not cryptography. No hash, cipher, or crypto operations exist in the codebase.
High
False Positive: Shell Backtick Execution
Scanner flagged backticks in markdown as shell execution. These are markdown code blocks showing example commands, not actual code execution.
Backticks in SKILL.md are within markdown fenced code blocks (```bash). They are documentation examples, not executable code.
High
False Positive: Hidden File Access
Scanner flagged accessing ~/.claude, ~/.codex as hidden file access. These are required session storage paths for reading AI assistant conversation history.
Accessing session storage at ~/.claude/projects/, ~/.codex/sessions/ is required functionality for the skill to read conversation history for analysis.
Low
False Positive: System Reconnaissance
Scanner flagged file system access as system reconnaissance. This is legitimate session storage access required for the tool to function.
Accessing ~/.local/share/opencode/storage/ is required to read session messages. This is intended functionality, not reconnaissance.
No confirmed security findings were recorded for this completed audit.
Audited by: claude