Audit History
doctoral-ti-news-cvlac - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Aug 7, 2026, 10:04 AM | No confirmed findings | 0 | No capability change |
| v3 | Jul 6, 2026, 03:06 PM | No confirmed findings | 0 | No capability change |
| v2 | Jul 6, 2026, 03:06 PM | No confirmed findings | 0 | External commands |
| v1 | Jun 29, 2026, 07:49 PM | No confirmed findings | 1 | Baseline |
Aug 7, 2026, 10:04 AM
All 54 static findings are false positives after review. The network matches are documentation and example URLs, while the external-command matches are Markdown code spans and fenced examples; no executable command path or prompt-injection text was found.
Risk Factors
🌐 Network access (8)
⚙️ External commands (46)
Jul 6, 2026, 03:06 PM
AI review found the 72 static findings are documentation false positives: public URLs, JSON schema metadata, workflow labels, and Markdown backticks. No prompt-injection text, credential handling, malicious scripts, or executable command paths were found in the reviewed files.
Risk Factors
🌐 Network access (23)
⚙️ External commands (46)
Jul 6, 2026, 03:06 PM
AI review found the 72 static findings are documentation false positives: public URLs, JSON schema metadata, workflow labels, and Markdown backticks. No prompt-injection text, credential handling, malicious scripts, or executable command paths were found in the reviewed files.
Risk Factors
🌐 Network access (23)
⚙️ External commands (46)
Jun 29, 2026, 07:49 PM
Static analysis reported many command execution and weak cryptography patterns, but review found these are Markdown examples, schema field names, URLs, and academic metadata text rather than executable code. The only confirmed risk factor is intentional network use for public academic and official Colombian research sources, with clear guidance to avoid credentials, sensitive identity data, and mass scraping.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.