📦

Audit History

skill-check - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v7 Latest	Jul 21, 2026, 07:37 AM	No confirmed findings	0	No capability change
v6	Jul 9, 2026, 07:02 AM	2 confirmed	0	No capability change
v5	Jul 9, 2026, 04:00 AM	49 confirmed	69	No capability change
v4	Jul 5, 2026, 06:37 PM	2 confirmed	0	No capability change
v3	Jul 5, 2026, 06:37 PM	2 confirmed	0	No capability change
v2	Jun 30, 2026, 03:56 AM	No confirmed findings	3	Network accessContains scriptsEnv variables
v1	Apr 30, 2026, 08:55 AM	No confirmed findings	0	Baseline

Audit version 7 Latest

Jul 21, 2026, 07:37 AM

All 118 static findings are false positives after contextual review. They occur in Markdown documentation, evaluation expectations, or deliberately insecure fixtures that teach the skill to identify unsafe code. The operational instructions require a security review before script testing and provide no evidence of prompt injection, data exfiltration, or unauthorized execution.

Files scanned

3,439

Lines analyzed

Review items

False positives ignored

Risk Factors

⚡ Contains scripts (5)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (24)

⚙️ External commands (38)

🌐 Network access (1)

evals/files/insecure-skill/scripts/fetch_data.py:15

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Audited by: claude

Audit version 6

Jul 9, 2026, 07:02 AM

Most static findings are false positives from Markdown examples, validation documentation, and deliberate eval fixtures. I found two semantic risks: execution of target skill scripts during Standard or Deep checks, and package installation guidance that can alter system Python. No prompt injection attempt was found in the reviewed files.

Files scanned

3,439

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:157-159 references/standard-check.md:59-75

Target Skill Script Execution During Standard Checks

Standard and Deep workflows include executing scripts from the skill being tested. This can run untrusted community code if the user selects an unsafe target skill.

The instructions explicitly include script execution with mock inputs and sample commands. Existing warnings reduce risk, but execution remains part of the default Standard path.

Medium

references/mock-files.md:33-53

System Python Package Installation Guidance

The mock file guidance tells agents to install packages with --break-system-packages. That can modify the host Python environment and bypass package manager safeguards.

The commands are explicit pip install examples using --break-system-packages. The packages are common, but the installation method is risky for shared environments.

Risk Factors

⚡ Contains scripts (5)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (24)

⚙️ External commands (38)

🌐 Network access (1)

evals/files/insecure-skill/scripts/fetch_data.py:15

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Audited by: codex

Audit version 5

Jul 9, 2026, 04:00 AM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Files scanned

3,439

Lines analyzed

123

Review items

False positives ignored

Confirmed security concerns (49)

Critical

references/quick-check.md:306

SSH directory access

- Writing to sensitive paths: `/etc/`, `/usr/`, `~/.ssh/`, `~/.config/`, system dirs

High

references/quick-check.md:142

Hex-encoded characters

valid_headers = [b'\x00\x01\x00\x00', b'OTTO', b'true', b'typ1', b'wOFF', b'wOF2']

Low

CONTRIBUTING.md:59

System reconnaissance

SkillCheck follows the Agent Skills open standard. Avoid adding checks or behaviour

Low

evals/evals.json:88

System reconnaissance

"Script produces bullet-point output when given valid input",

Low

evals/files/healthy-skill/scripts/extract_key_points.py:16

System reconnaissance

print(f"Error: File is not valid UTF-8 text: {filepath}", file=sys.stderr)

Low

references/best-practices.md:150

System reconnaissance

- Keep file references one level deep from SKILL.md (per spec). Avoid deeply nested

Low

references/best-practices.md:190

System reconnaissance

- When NOT to use it (to avoid false positives)

Low

references/best-practices.md:255

System reconnaissance

**Severity:** Advisory. Skills with unexplained rigid rules tend to produce brittle outputs.

Low

references/best-practices.md:298

System reconnaissance

- Examples treated as the only valid input rather than illustrations

Low

references/best-practices.md:340

System reconnaissance

- Redundant instructions (the same thing said multiple ways)

Low

references/best-practices.md:401

System reconnaissance

✓ BP-1: Name format — "csv-chart", matches directory, valid format

Low

references/deep-check.md:20

System reconnaissance

1. **Empty input** — A valid file of the correct type but with no meaningful content.

Low

references/deep-check.md:23

System reconnaissance

2. **Minimal input** — The absolute smallest valid input. One row, one field, one word.

Low

references/deep-check.md:59

System reconnaissance

5. Evaluate: did the output match what the skill promised?

Low

references/eval-schema.md:24

System reconnaissance

"Output is a valid .pptx file",

Low

references/eval-schema.md:36

System reconnaissance

"Output is a valid PNG image",

Low

references/eval-schema.md:73

System reconnaissance

1. **Schema check** — Is it valid JSON? Does it have `skill_name` and `evals`?

Low

references/eval-schema.md:80

System reconnaissance

Any validation failure is reported but doesn't prevent other valid evals from running.

Low

references/eval-schema.md:96

System reconnaissance

- "Output is a valid .pptx file" → Check file exists and is parseable

Low

references/eval-schema.md:148

System reconnaissance

- Good: "Output is a valid .pptx file with exactly 5 slides"

Low

references/eval-schema.md:153

System reconnaissance

- Bad: "Output is a valid PDF and contains a table with 3 columns and a chart"

Low

references/eval-schema.md:171

System reconnaissance

"Output is a valid .docx file",

Low

references/example-run.md:147

System reconnaissance

> - S3: Script syntax — generate_chart.py parses as valid Python

Low

references/example-run.md:172-173

System reconnaissance

> - W-1: Step completability — Python available, script exists, paths valid

Low

references/example-run.md:194

System reconnaissance

generate_chart.py parses as valid Python.

Low

references/example-run.md:279

System reconnaissance

Generated valid PNG chart (bar chart, 800x600).

Low

references/example-run.md:288

System reconnaissance

Script produced a valid bar chart PNG with labeled axes.

Low

references/example-run.md:406-407

System reconnaissance

✓ BP-1: Name format — valid

Low

references/finding-the-skill.md:10

System reconnaissance

- Did the user mention a skill name or path earlier?

Low

references/finding-the-skill.md:11

System reconnaissance

- Did they just finish building a skill with skill-creator? If so, the path is likely

Low

references/finding-the-skill.md:13

System reconnaissance

- Did they upload files that include a SKILL.md?

Low

references/mock-files.md:305

System reconnaissance

# Draw a grid and label

Low

references/mock-files.md:350-351

System reconnaissance

For any code file type (.py, .js, .ts, .sh, .sql, etc.), generate syntactically valid

Low

references/mock-files.md:352

System reconnaissance

small valid Python module. If it processes SQL, write a few CREATE TABLE / SELECT statements.

Low

references/mock-files.md:362

System reconnaissance

3. If binary and no library, create the simplest valid file of that type you can

Low

references/quick-check.md:57

System reconnaissance

files referenced by the skill), verify it's a valid file of its claimed type:

Low

references/quick-check.md:71

System reconnaissance

For SVG, check it's valid XML with an `<svg>` root element:

Low

references/quick-check.md:78

System reconnaissance

print('PASS: valid SVG')

Low

references/quick-check.md:108

System reconnaissance

If the required library isn't available, fall back to checking the file is a valid ZIP

Low

references/quick-check.md:113

System reconnaissance

assert zipfile.is_zipfile('<file>'), 'Not a valid ZIP-based document'

Low

references/quick-check.md:114

System reconnaissance

print('PASS: valid ZIP container')

Low

references/quick-check.md:128

System reconnaissance

print('PASS: valid PDF structure')

Low

references/report-format.md:211

System reconnaissance

- **S2** Script syntax: scripts/build_chart.py valid Python ✓

Low

references/report-format.md:213

System reconnaissance

- **IO1** Happy path: CSV → PPTX conversion produced valid 5-slide deck ✓

Low

references/report-format.md:350-351

System reconnaissance

✓ BP-1: Name format — valid

Low

references/standard-check.md:29

System reconnaissance

and input file existence. Report any validation errors but continue with valid evals.

Low

references/standard-check.md:40

System reconnaissance

- Descriptive assertions ("output should be a valid PDF") — evaluate by inspection

Low

references/standard-check.md:68

System reconnaissance

2. **Generate minimal mock input** — Create the simplest valid input the script needs.

Low

references/standard-check.md:80

System reconnaissance

- Output files are non-empty and parseable (e.g., valid PNG, valid JSON)

Capability review items (69)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

evals/evals.json:60

Dynamic code evaluation with eval()

"expected_output": "A report with multiple Critical security findings. The script contains shell inj

High

evals/evals.json:67

Dynamic code evaluation with eval()

"Security review flags eval() usage as Critical (arbitrary code execution)",

High

evals/files/insecure-skill/scripts/fetch_data.py:27

Dynamic code evaluation with eval()

result = eval(expression)

High

evals/files/insecure-skill/scripts/fetch_data.py:21

Python os.system

os.system(f"{user_command} {filepath}")

High

evals/files/insecure-skill/scripts/fetch_data.py:11

Generic API/secret keys

API_KEY = "sk-abc123-fake-key-for-testing-purposes"

High

README.md:46

Hidden file in home directory

cp -r skill-check ~/.claude/skills/

High

references/finding-the-skill.md:31

Hidden file in home directory

- `~/.claude/skills/` — personal skills

High

references/quick-check.md:300

Dynamic code evaluation with eval()

- Arbitrary code execution: `eval()`, `exec()`, `compile()` with dynamic input

High

references/quick-check.md:298

Python subprocess.run

- Shell injection: `os.system(f"...")`, `subprocess.run(f"...", shell=True)` with

High

references/quick-check.md:298

Python os.system

- Shell injection: `os.system(f"...")`, `subprocess.run(f"...", shell=True)` with

High

references/quick-check.md:306

Hidden file in home directory

- Writing to sensitive paths: `/etc/`, `/usr/`, `~/.ssh/`, `~/.config/`, system dirs

High

references/report-format.md:238

Python subprocess.run

- **SEC-I1**: `scripts/build_chart.py` uses `subprocess.run()` — appears properly

High

references/standard-check.md:124

Dynamic code evaluation with eval()

- Eval regression: 1 per existing eval (0 if none exist)

Medium

evals/files/broken-skill/scripts/convert.py:15

Python file write/append

with open(out_path, 'w') as f:

Medium

evals/files/insecure-skill/scripts/fetch_data.py:16 references/mock-files.md:135 references/mock-files.md:157 references/mock-files.md:182 references/mock-files.md:324

Python file write/append · 5 occurrences

with open(output_path, 'w') as f:

Medium

evals/files/insecure-skill/scripts/fetch_data.py:32

Python file write/append

with open("/etc/app-config.json", 'w') as f:

Medium

README.md:46

Hidden file access

cp -r skill-check ~/.claude/skills/

Medium

references/example-run.md:59-68

Ruby/shell backtick execution

`python3 scripts/generate_chart.py --input <csv-path> --output <chart-path> --type <chart-type>`

Medium

references/finding-the-skill.md:31

Hidden file access

- `~/.claude/skills/` — personal skills

Medium

references/mock-files.md:98

Python file write/append

with open(output_path, 'w', newline='') as f:

Medium

references/mock-files.md:336 references/quick-check.md:112

Python archive libraries · 2 occurrences

import zipfile

Medium

references/mock-files.md:340

Python archive libraries

with zipfile.ZipFile(output_path, 'w') as zf:

Medium

references/quick-check.md:306

Hidden file access

- Writing to sensitive paths: `/etc/`, `/usr/`, `~/.ssh/`, `~/.config/`, system dirs

Medium

references/quick-check.md:113

Python archive libraries

assert zipfile.is_zipfile('<file>'), 'Not a valid ZIP-based document'

Medium

references/report-format.md:234-238

Ruby/shell backtick execution

- **SEC-W1**: `scripts/fetch_data.py` line 42 — downloads from a URL constructed

Medium

references/report-format.md:238

Ruby/shell backtick execution

- **SEC-I1**: `scripts/build_chart.py` uses `subprocess.run()` — appears properly

Medium

references/report-format.md:281-282

Ruby/shell backtick execution

**What happened:** The script threw an unhandled `IndexError` on line 23:

Medium

references/report-format.md:282-288

Ruby/shell backtick execution

`IndexError: list index out of range`

Medium

references/report-format.md:302-304

Ruby/shell backtick execution

- **W-1**: `assets/old_logo.png` exists but is never referenced — orphaned file?

Medium

references/report-format.md:304-305

Ruby/shell backtick execution

- **W-3**: `scripts/build_chart.py` has no comments — maintainability concern

Medium

references/report-format.md:370-377

Ruby/shell backtick execution

1. Add argument validation to `scripts/build_chart.py` — currently crashes on missing input

Medium

references/report-format.md:377-378

Ruby/shell backtick execution

4. Remove orphaned `assets/old_logo.png`

Medium

references/report-format.md:378-380

Ruby/shell backtick execution

5. Add inline comments to `scripts/build_chart.py`

Medium

references/report-format.md:391-392

Ruby/shell backtick execution

2. Remove orphaned `assets/old_logo.png`

Medium

references/standard-check.md:73

Temp directory access

python3 scripts/build_chart.py --input mock_data.csv --output /tmp/test_output.png 2>&1

Medium

SKILL.md:43

Ruby/shell backtick execution

For a worked example of a Standard Check from start to finish, see `references/example-run.md`.

Medium

SKILL.md:49

Ruby/shell backtick execution

- The `evals.json` format must match the skill-creator schema exactly (see

Medium

SKILL.md:50

Ruby/shell backtick execution

`references/eval-schema.md`). Don't invent a new format — compatibility with

Medium

SKILL.md:55

Ruby/shell backtick execution

See `references/mock-files.md` for the dependency list.

Medium

SKILL.md:69

Ruby/shell backtick execution

`references/incomplete-skills.md` and reframe.

Medium

SKILL.md:74

Ruby/shell backtick execution

- The frontmatter `name` field must match the parent directory name per the Agent

Medium

SKILL.md:79

Ruby/shell backtick execution

See `references/report-format.md` for collapsing rules.

Medium

SKILL.md:89

Ruby/shell backtick execution

If the user gives a specific path, use it. If not, read `references/finding-the-skill.md`

Medium

SKILL.md:98

Ruby/shell backtick execution

| **Core** | `SKILL.md` — the main instructions file |

Medium

SKILL.md:99

Ruby/shell backtick execution

| **Scripts** | `scripts/` — executable code (Python, Bash, JS, etc.) |

Medium

SKILL.md:100

Ruby/shell backtick execution

| **References** | `references/` — documentation loaded into context as needed |

Medium

SKILL.md:101

Ruby/shell backtick execution

| **Assets** | `assets/` — templates, icons, fonts, images used in output |

Medium

SKILL.md:104

Ruby/shell backtick execution

| **Evals** | `evals/` — existing test cases (if any) |

Medium

SKILL.md:132

Ruby/shell backtick execution

integrity during testing — see `references/quick-check.md`.

Medium

SKILL.md:134

Ruby/shell backtick execution

- **Evals**: Read `evals.json` if present. See `references/eval-schema.md` for the format.

Medium

SKILL.md:142

Ruby/shell backtick execution

stub scripts), read `references/incomplete-skills.md` and adjust your approach — reframe

Medium

SKILL.md:154

Ruby/shell backtick execution

- **Quick:** `references/quick-check.md` — static integrity, asset validation, SKILL.md

Medium

SKILL.md:156

Ruby/shell backtick execution

22 best practice checks (`references/best-practices.md`)

Medium

SKILL.md:157

Ruby/shell backtick execution

- **Standard:** `references/standard-check.md` — everything in Quick, plus eval regression

Medium

SKILL.md:158

Ruby/shell backtick execution

(`references/eval-schema.md`), script execution with mock inputs (`references/mock-files.md`),

Medium

SKILL.md:160

Ruby/shell backtick execution

- **Deep:** `references/deep-check.md` — everything in Standard, plus edge case inputs,

Medium

SKILL.md:193

Ruby/shell backtick execution

Read `references/report-format.md` for the full template and collapsing rules. Key elements:

Medium

SKILL.md:204

Ruby/shell backtick execution

`references/report-format.md` for which sections to skip at each depth level.

Low

evals/files/insecure-skill/scripts/fetch_data.py:15

Python HTTP libraries

response = requests.get(url, verify=False)

Low

references/mock-files.md:59

Standard device file access

python3 -c "import openpyxl" 2>/dev/null && echo "openpyxl: available" || echo "openpyxl: needs inst

Low

references/mock-files.md:60

Standard device file access

python3 -c "import docx" 2>/dev/null && echo "python-docx: available" || echo "python-docx: needs in

Low

references/mock-files.md:61

Standard device file access

python3 -c "import pptx" 2>/dev/null && echo "python-pptx: available" || echo "python-pptx: needs in

Low

references/mock-files.md:62

Standard device file access

python3 -c "import fpdf" 2>/dev/null && echo "fpdf2: available" || echo "fpdf2: needs install"

Low

references/mock-files.md:63

Standard device file access

python3 -c "import PIL" 2>/dev/null && echo "Pillow: available" || echo "Pillow: needs install"

Risk Factors

⚡ Contains scripts (5)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (24)

⚙️ External commands (38)

🌐 Network access (1)

evals/files/insecure-skill/scripts/fetch_data.py:15

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Detected Patterns

System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSSH directory accessSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance

Audited by: claude

Audit version 4

Jul 5, 2026, 06:37 PM

Most static pattern hits are documentation examples, Markdown formatting, or deliberately unsafe eval fixtures rather than active malicious code. No prompt injection evidence was found in the reviewed files. Two semantic risks remain: target script execution in Standard and Deep checks, and unpinned pip installation guidance using --break-system-packages.

Files scanned

3,439

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/standard-check.md:16-19 references/standard-check.md:59-75

Untrusted Target Script Execution

Standard and Deep workflows instruct the agent to execute scripts from the skill being tested after static review. This can run untrusted code from a user-selected skill directory if the review misses a dangerous pattern.

The guide explicitly runs scripts from the target skill and only requires a warning when Critical findings were detected. This is a real execution risk for untrusted skills, although it supports the testing purpose.

High

references/mock-files.md:33-53

Unpinned Package Installation With System Package Override

Mock generation guidance tells the agent to install third-party packages with pip and --break-system-packages when binary formats are needed. This can modify the host Python environment and exposes users to dependency supply-chain risk.

The dependency section directly recommends pip install commands without pinning, hashes, virtual environments, or mandatory user confirmation. The --break-system-packages flag increases the environment modification risk.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

references/quick-check.md:306

SSH directory access

- Writing to sensitive paths: `/etc/`, `/usr/`, `~/.ssh/`, `~/.config/`, system dirs

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Risk Factors

⚡ Contains scripts (5)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (24)

⚙️ External commands (38)

🌐 Network access (1)

evals/files/insecure-skill/scripts/fetch_data.py:15

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Audited by: codex

Audit version 3

Jul 5, 2026, 06:37 PM

Files scanned

3,439

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/standard-check.md:16-19 references/standard-check.md:59-75

Untrusted Target Script Execution

High

references/mock-files.md:33-53

Unpinned Package Installation With System Package Override

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

references/quick-check.md:306

SSH directory access

- Writing to sensitive paths: `/etc/`, `/usr/`, `~/.ssh/`, `~/.config/`, system dirs

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Risk Factors

⚡ Contains scripts (5)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (24)

⚙️ External commands (38)

🌐 Network access (1)

evals/files/insecure-skill/scripts/fetch_data.py:15

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Audited by: codex

Audit version 2

Jun 30, 2026, 03:56 AM

Static analysis found many dangerous patterns, but review shows most are intentional security-review examples or test fixtures. The skill is not blocked because no malicious intent or prompt injection was found, but Standard and Deep checks can execute untrusted skill scripts and require user review before running.

Files scanned

3,439

Lines analyzed

Review items

False positives ignored

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:157-159 references/standard-check.md:71-74

Untrusted Skill Scripts May Be Executed During Deeper Checks

Standard and Deep workflows include script execution with mock inputs after a security review. This is a legitimate testing feature, but running scripts from an arbitrary skill can execute attacker-controlled code if the preliminary review misses a risk.

The workflow explicitly includes script execution. The skill also instructs reviewers to warn before executing scripts with critical findings, which reduces but does not remove the risk.

Low

references/quick-check.md:295-309

Dangerous Patterns Are Primarily Documentation Examples

Many external command, eval, sensitive path, and credential patterns appear in security-review guidance that teaches the agent what to flag. These are not instructions to perform malicious actions.

The cited section is under a security review heading and defines which unsafe patterns should be reported. The surrounding context confirms educational intent.

Low

evals/files/insecure-skill/scripts/fetch_data.py:1-3 evals/files/insecure-skill/scripts/fetch_data.py:11-33

Intentionally Insecure Fixture Contains Real Anti-Patterns

The insecure fixture includes a fake API key, disabled TLS verification, os.system, eval, and a sensitive path write. The file states it is a test fixture and should not be used in production.

The risky code is real, but the header explicitly marks it as a deliberate test fixture. Its use in eval expectations supports that interpretation.

Risk Factors

⚙️ External commands (355)

🌐 Network access (7)

CONTRIBUTING.md:30 evals/files/insecure-skill/scripts/fetch_data.py:15 README.md:3 README.md:60 README.md:134 references/best-practices.md:16 references/mock-files.md:320

⚡ Contains scripts (6)

evals/evals.json:60 evals/evals.json:67 evals/files/insecure-skill/scripts/fetch_data.py:27 references/quick-check.md:300 references/quick-check.md:300 references/standard-check.md:124

📁 Filesystem access (27)

evals/files/broken-skill/scripts/convert.py:15 evals/files/insecure-skill/scripts/fetch_data.py:16 evals/files/insecure-skill/scripts/fetch_data.py:32 README.md:46 README.md:46 references/finding-the-skill.md:31 references/finding-the-skill.md:31 references/mock-files.md:59 references/mock-files.md:60 references/mock-files.md:61 references/mock-files.md:62 references/mock-files.md:63 references/mock-files.md:98 references/mock-files.md:135 references/mock-files.md:157 references/mock-files.md:182 references/mock-files.md:324 references/mock-files.md:336 references/mock-files.md:340 references/quick-check.md:306 references/quick-check.md:306 references/quick-check.md:306 references/quick-check.md:306 references/quick-check.md:112 references/quick-check.md:113 references/quick-check.md:113 references/standard-check.md:73

🔑 Env variables (1)

evals/files/insecure-skill/scripts/fetch_data.py:11

Detected Patterns

Shell Command Execution Pattern In FixtureDynamic Code Evaluation Pattern In FixtureSensitive Path And Network Patterns In Fixture

Audited by: codex

Audit version 1

Apr 30, 2026, 08:55 AM

SkillCheck is legitimate testing infrastructure for Claude skills. Static findings flagged test fixtures containing intentionally vulnerable code (eval, os.system, hardcoded API keys) and example documentation. The skill correctly uses Bash and filesystem tools to run tests on user-provided skill directories - this is expected behavior for a testing/auditing skill. No evidence of malicious intent. Test fixtures are clearly labeled and isolated.

Files scanned

3,469

Lines analyzed

Review items

False positives ignored

Risk Factors

⚙️ External commands (1)

SKILL.md:43

📁 Filesystem access (1)

SKILL.md:89

Audited by: claude

← Back to Skill