Versioned security assessment

Report ID: SA-30C73EAC

7/5/2026, 3:06:34 PM

vet security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
vet
Version
v4
Maintainer
imbue-ai
Source
github.com/imbue-ai/vet/tree/main/skills/vet
Coverage
4 Files scanned · 269 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill intentionally runs local vet commands and optional history-loader scripts that read assistant conversation files under hidden home directories. Many markdown backtick detections are false positives, but the documented command execution and transcript access are real privacy and execution risks. No prompt injection language or direct network exfiltration code was found in the reviewed files.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 269 Lines analyzed

22 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 6 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 22 evidence locations

Capability review items (19)
High
SKILL.md:33
Hidden file in home directory
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode command runs a Python script from a hidden home directory path. It is part of the intended setup, but hidden home access is a real privacy and integrity risk.
High
SKILL.md:38
Hidden file in home directory
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex command references a hidden ~/.codex skill path and takes a session file. This can expose local assistant conversation history.
High
SKILL.md:43
Hidden file in home directory
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code command references a hidden ~/.claude skill path and a session file. This is intended but still sensitive hidden-home access.
High
SKILL.md:55
Hidden file in home directory
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The grep command searches ~/.local/share/opencode storage for conversation text. That directory can contain sensitive local session history.
High
SKILL.md:60
Hidden file in home directory
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance directs users to inspect ~/.codex/sessions for the correct conversation. Codex session files can contain prompts, code, and secrets.
High
SKILL.md:62
Hidden file in home directory
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance directs users to inspect ~/.claude/projects for conversation files. Those hidden files may contain sensitive project and prompt data.
Medium
SKILL.md:16-25
Ruby/shell backtick execution
```bash
The fenced block instructs users to run pip, uv, and vet commands. Installing and executing a package is a real external command risk, even though the markdown fence itself is benign.
Medium
SKILL.md:32-34
Ruby/shell backtick execution
```bash
The OpenCode example runs the vet CLI and a Python history-loader script. That is intentional external command execution with local data access.
Medium
SKILL.md:37-39
Ruby/shell backtick execution
```bash
The Codex example runs vet with a Python history-loader script. This is external command execution that can process local session files.
Medium
SKILL.md:42-44
Ruby/shell backtick execution
```bash
The Claude Code example runs vet with a Python history-loader script. This is a real external command path that can read local conversation history.
Medium
SKILL.md:47-49
Ruby/shell backtick execution
```bash
The example instructs running the vet CLI. Even without history loading, it executes a local command over repository state.
Medium
SKILL.md:55-57
Ruby/shell backtick execution
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The instruction uses grep over OpenCode storage to locate a session. This is external command execution against local application data.
Medium
SKILL.md:77-78
Ruby/shell backtick execution
- `--agentic`: Mode that routes analysis through the locally installed Claude Code or Codex CLI inst
The --agentic option states that vet routes analysis through local Claude Code or Codex CLIs. That mode can invoke external local tools, although only when selected.
Medium
SKILL.md:33
Hidden file access
vet "goal" --history-loader "python ~/.agents/skills/vet/scripts/export_opencode_session.py --sessio
The OpenCode example executes a loader from a hidden home directory. This hidden-file access is expected for the skill but should be consent-gated.
Medium
SKILL.md:38
Hidden file access
vet "goal" --history-loader "python ~/.codex/skills/vet/scripts/export_codex_session.py --session-fi
The Codex example uses a hidden ~/.codex path and a session file. Access to that data is privacy-sensitive even when used for code review.
Medium
SKILL.md:43
Hidden file access
vet "goal" --history-loader "python ~/.claude/skills/vet/scripts/export_claude_code_session.py --ses
The Claude Code example uses a hidden ~/.claude path and session file. The access is intentional but sensitive.
Medium
SKILL.md:55
Hidden file access
2. Run: `grep -rl "UNIQUE_MESSAGE" ~/.local/share/opencode/storage/part/` to find the matching part
The command searches hidden OpenCode storage for a unique message. That is direct access to local conversation data.
Medium
SKILL.md:60
Hidden file access
**Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. Find the correct conversatio
The guidance instructs locating files under ~/.codex/sessions. This is hidden-file access to assistant transcripts.
Medium
SKILL.md:62
Hidden file access
**Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path
The guidance instructs locating files under ~/.claude/projects. This is hidden-file access to assistant transcripts.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:10SKILL.md:33-43SKILL.md:55-62
Sensitive Conversation History Exposure
The skill is designed to review conversation history along with git diffs. The documented history loaders and session discovery steps can expose prompts, assistant replies, code, file paths, and secrets to vet processing.
The documentation explicitly says vet reviews conversation history and gives loader commands for OpenCode, Codex, and Claude Code. The listed hidden session paths are known places where sensitive transcripts are stored.
RISK-002 Medium
SKILL.md:3SKILL.md:8
Autonomous Tool Execution Pressure
The skill tells agents to run vet immediately after each logical unit of code changes and not wait to be asked. This can lead to unrequested command execution, especially when combined with history-loader guidance.
The instruction is repeated in the front matter and main text. It is not malicious by itself, but it creates consent risk for commands that inspect local data.
RISK-003 Medium
scripts/export_opencode_session.py:8-12scripts/export_opencode_session.py:32-34
Unvalidated Session Identifier Used in File Paths
The OpenCode exporter uses the supplied session id to build a filesystem path before validating the expected ses_ format. A malformed value could cause unintended directory traversal behavior in local file reads.
The path is directly derived from user input and message ids without visible normalization or validation. Exploitability is limited because the script expects OpenCode-shaped local JSON, so confidence is medium.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Sensitive conversation history access
    Require explicit user confirmation before using history loaders, document every directory read, and default to running vet without history.
  2. FIX-002
    High
    Hidden application directory search
    Replace broad grep guidance with a safer session selector, or limit searches to user-approved files and redact sensitive text before processing.
  3. FIX-003
    Medium
    External command and package execution
    Avoid automatic pip, uv, or vet execution. Pin package versions and ask before running commands that process repository or session data.
  4. FIX-004
    Medium
    Unvalidated OpenCode session id
    Validate that --session-id starts with ses_ and contains no path separators before building filesystem paths.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
30c73eac2afe762f6aa9c4553158769369d47351
Content hash
51b09f0cc32d37d1b55cdcbcde9ce8d11aedc8d415426f9281d960d0c1fdc7d7
Tree hash
3544d7014a9905fcfd7e98805378dc56bdabb892bb477895691f2a6318ec7c0b
Skill path
skills/imbue-ai/vet
Audit payload hash
0f045f760386e8804b03eadb13670123

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable