Skills baoyu-format-markdown Audit History

📦

Audit History

baoyu-format-markdown - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v5 Latest	Aug 7, 2026, 10:40 AM	No confirmed findings	2	Network access
v4	Jul 6, 2026, 03:33 PM	2 confirmed	18	No capability change
v3	Jul 6, 2026, 03:33 PM	2 confirmed	18	No capability change
v2	Jun 30, 2026, 03:40 AM	2 confirmed	3	Network access
v1	Feb 17, 2026, 08:56 AM	2 confirmed	3	Baseline

Audit version 5 Latest

Aug 7, 2026, 10:40 AM

The audit found one confirmed high-risk behavior: the formatter launches npx to execute autocorrect-node, which introduces external package and host-command risk. The remaining findings are false positives caused by documentation syntax, expected file formatting operations, dependency metadata, integrity hashes, or fixed text escapes; no prompt injection or data-exfiltration intent was found.

Files scanned

1,908

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/autocorrect.ts:1

Node.js child_process module

import { spawnSync } from "node:child_process";

This import supports the formatter's external npx execution path. The behavior is intentional, but running a package through a host process is a real execution and supply-chain risk.

High

scripts/autocorrect.ts:6

Synchronous spawn

const result = spawnSync(npxCmd, ["autocorrect-node", "--fix", filePath], {

The formatter synchronously launches npx to run autocorrect-node with the user-provided file path. This executes an external package during formatting and creates supply-chain and host-command risk.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (5)

scripts/main.ts:1 scripts/main.ts:102 scripts/main.ts:108 SKILL.md:47 SKILL.md:48

🌐 Network access (50)

Audited by: codex

Audit version 4

Jul 6, 2026, 03:33 PM

Most static matches are false positives from Markdown backticks, help text, and package lockfile integrity hashes. Confirmed risks remain around shell execution of unescaped file paths, unpinned npx package execution, in-place file writes, and hidden configuration reads.

Files scanned

671

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/autocorrect.ts:5 SKILL.md:212-214 SKILL.md:230-241

Unpinned Runtime Package Execution

The workflow runs npx commands that can fetch and execute current registry packages during formatting, including bun and autocorrect-node.

Both code and workflow instructions use npx without pinned package versions. That creates a supply-chain execution risk beyond the generic external-command pattern.

Medium

SKILL.md:20-48

Untrusted Hidden Configuration Can Influence Agent Behavior

The skill directs the agent to read project and home EXTEND.md files and apply their settings, which can let repository-local hidden files steer behavior.

The instructions explicitly define hidden configuration locations and say to read, parse, and apply settings. No direct malicious text was found, but the trust boundary is real.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/autocorrect.ts:1

Node.js child_process module

import { execSync } from "child_process";

The child_process import is used by this helper to run execSync. That gives the formatter shell execution capability during normal use.

High

scripts/autocorrect.ts:5

Synchronous process execution

execSync(`npx autocorrect-node --fix "${filePath}"`, { stdio: "inherit" });

execSync runs a shell command containing the user-supplied file path. Quoting does not safely handle embedded quotes or shell metacharacters, so command injection is possible.

High

scripts/autocorrect.ts:5

Ruby/shell backtick execution

execSync(`npx autocorrect-node --fix "${filePath}"`, { stdio: "inherit" });

execSync runs a shell command containing the user-supplied file path. Quoting does not safely handle embedded quotes or shell metacharacters, so command injection is possible.

Medium

scripts/main.ts:1

Synchronous file operations

import { readFileSync, writeFileSync } from "fs";

The imported synchronous file APIs are used below to read and overwrite the target path. This is expected for a formatter but is still real filesystem capability.

Medium

scripts/main.ts:102

Synchronous file operations

const content = readFileSync(filePath, "utf-8");

The script reads the CLI-provided file path without path or extension validation. This is intended behavior but broadens local file access.

Medium

scripts/main.ts:108

Synchronous file operations

writeFileSync(filePath, formattedContent, "utf-8");

The script writes formatted content back to the provided file path. An incorrect or malicious path could overwrite local files within the agent permissions.

Medium

SKILL.md:24-30 SKILL.md:197-203 SKILL.md:212-214 SKILL.md:230-242

Ruby/shell backtick execution · 4 occurrences

```bash

The skill tells the agent to use Bash commands to probe configuration files. The commands are limited, but they still cause shell execution.

Medium

SKILL.md:30-66 SKILL.md:203-206 SKILL.md:214-220 SKILL.md:242-247

Ruby/shell backtick execution · 4 occurrences

```

The skill tells the agent to use Bash commands to probe configuration files. The commands are limited, but they still cause shell execution.

Medium

SKILL.md:201

Shell command substitution

mv "{filename}-formatted.md" "{filename}-formatted.backup-$(date +%Y%m%d-%H%M%S).md"

This backup workflow uses a Bash mv command and command substitution. It is a real shell instruction that may operate on generated file paths.

Medium

SKILL.md:197-203

Template literal with command substitution

```bash

This backup workflow uses a Bash mv command and command substitution. It is a real shell instruction that may operate on generated file paths.

Medium

SKILL.md:29

Hidden file access

test -f "$HOME/.baoyu-skills/baoyu-format-markdown/EXTEND.md" && echo "user"

The skill explicitly checks hidden project and home-directory EXTEND.md paths and applies settings from them. That is real hidden file access outside the requested document.

Medium

SKILL.md:37

Hidden file access

│ $HOME/.baoyu-skills/baoyu-format-markdown/EXTEND.md │ User home │

The skill explicitly checks hidden project and home-directory EXTEND.md paths and applies settings from them. That is real hidden file access outside the requested document.

Risk Factors

⚙️ External commands (68)

scripts/autocorrect.ts:1 scripts/autocorrect.ts:5 scripts/autocorrect.ts:5 scripts/main.ts:115 scripts/main.ts:118 scripts/main.ts:144-153 scripts/main.ts:163 SKILL.md:12 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:24-30 SKILL.md:30-66 SKILL.md:66-67 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70-71 SKILL.md:71-86 SKILL.md:86-102 SKILL.md:102-112 SKILL.md:112-121 SKILL.md:121-127 SKILL.md:127-128 SKILL.md:128 SKILL.md:129-130 SKILL.md:130 SKILL.md:135-136 SKILL.md:136-142 SKILL.md:142-144 SKILL.md:144-150 SKILL.md:150-168 SKILL.md:168 SKILL.md:169-170 SKILL.md:170 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:183 SKILL.md:186 SKILL.md:187 SKILL.md:190 SKILL.md:195 SKILL.md:197-203 SKILL.md:203-206 SKILL.md:206 SKILL.md:212-214 SKILL.md:214-220 SKILL.md:220 SKILL.md:221-222 SKILL.md:222 SKILL.md:223-224 SKILL.md:224 SKILL.md:225-226 SKILL.md:226 SKILL.md:230-242 SKILL.md:242-247 SKILL.md:247 SKILL.md:252-262 SKILL.md:262-267 SKILL.md:267-269 SKILL.md:269-272 SKILL.md:272-286 SKILL.md:286-287 SKILL.md:287-292 SKILL.md:292 SKILL.md:201 SKILL.md:197-203

📁 Filesystem access (5)

scripts/main.ts:1 scripts/main.ts:102 scripts/main.ts:108 SKILL.md:29 SKILL.md:37

Audited by: codex

Audit version 3

Jul 6, 2026, 03:33 PM

Files scanned

671

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/autocorrect.ts:5 SKILL.md:212-214 SKILL.md:230-241

Unpinned Runtime Package Execution

The workflow runs npx commands that can fetch and execute current registry packages during formatting, including bun and autocorrect-node.

Both code and workflow instructions use npx without pinned package versions. That creates a supply-chain execution risk beyond the generic external-command pattern.

Medium

SKILL.md:20-48

Untrusted Hidden Configuration Can Influence Agent Behavior

The skill directs the agent to read project and home EXTEND.md files and apply their settings, which can let repository-local hidden files steer behavior.

The instructions explicitly define hidden configuration locations and say to read, parse, and apply settings. No direct malicious text was found, but the trust boundary is real.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/autocorrect.ts:1

Node.js child_process module

import { execSync } from "child_process";

The child_process import is used by this helper to run execSync. That gives the formatter shell execution capability during normal use.

High

scripts/autocorrect.ts:5

Synchronous process execution

execSync(`npx autocorrect-node --fix "${filePath}"`, { stdio: "inherit" });

execSync runs a shell command containing the user-supplied file path. Quoting does not safely handle embedded quotes or shell metacharacters, so command injection is possible.

High

scripts/autocorrect.ts:5

Ruby/shell backtick execution

execSync(`npx autocorrect-node --fix "${filePath}"`, { stdio: "inherit" });

execSync runs a shell command containing the user-supplied file path. Quoting does not safely handle embedded quotes or shell metacharacters, so command injection is possible.

Medium

scripts/main.ts:1

Synchronous file operations

import { readFileSync, writeFileSync } from "fs";

The imported synchronous file APIs are used below to read and overwrite the target path. This is expected for a formatter but is still real filesystem capability.

Medium

scripts/main.ts:102

Synchronous file operations

const content = readFileSync(filePath, "utf-8");

The script reads the CLI-provided file path without path or extension validation. This is intended behavior but broadens local file access.

Medium

scripts/main.ts:108

Synchronous file operations

writeFileSync(filePath, formattedContent, "utf-8");

The script writes formatted content back to the provided file path. An incorrect or malicious path could overwrite local files within the agent permissions.

Medium

SKILL.md:24-30 SKILL.md:197-203 SKILL.md:212-214 SKILL.md:230-242

Ruby/shell backtick execution · 4 occurrences

```bash

The skill tells the agent to use Bash commands to probe configuration files. The commands are limited, but they still cause shell execution.

Medium

SKILL.md:30-66 SKILL.md:203-206 SKILL.md:214-220 SKILL.md:242-247

Ruby/shell backtick execution · 4 occurrences

```

The skill tells the agent to use Bash commands to probe configuration files. The commands are limited, but they still cause shell execution.

Medium

SKILL.md:201

Shell command substitution

mv "{filename}-formatted.md" "{filename}-formatted.backup-$(date +%Y%m%d-%H%M%S).md"

This backup workflow uses a Bash mv command and command substitution. It is a real shell instruction that may operate on generated file paths.

Medium

SKILL.md:197-203

Template literal with command substitution

```bash

This backup workflow uses a Bash mv command and command substitution. It is a real shell instruction that may operate on generated file paths.

Medium

SKILL.md:29

Hidden file access

test -f "$HOME/.baoyu-skills/baoyu-format-markdown/EXTEND.md" && echo "user"

The skill explicitly checks hidden project and home-directory EXTEND.md paths and applies settings from them. That is real hidden file access outside the requested document.

Medium

SKILL.md:37

Hidden file access

│ $HOME/.baoyu-skills/baoyu-format-markdown/EXTEND.md │ User home │

The skill explicitly checks hidden project and home-directory EXTEND.md paths and applies settings from them. That is real hidden file access outside the requested document.

Risk Factors

⚙️ External commands (68)

📁 Filesystem access (5)

scripts/main.ts:1 scripts/main.ts:102 scripts/main.ts:108 SKILL.md:29 SKILL.md:37

Audited by: codex

Audit version 2

Jun 30, 2026, 03:40 AM

Static analysis found many command-like patterns, but most SKILL.md hits are Markdown documentation examples or formatting syntax. One confirmed issue remains: scripts/autocorrect.ts builds a shell command with a user-controlled file path, creating command injection risk. No prompt injection, network exfiltration, environment access, or malicious intent was found.

Files scanned

505

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Low

scripts/quotes.ts:1-4

Benign Unicode Escape Use

scripts/quotes.ts uses Unicode escapes for typographic quotation marks. This is not obfuscation and matches the documented quote replacement feature.

The escape sequences are immediately used as replacement quote characters. There is no hidden control flow, decoding layer, or suspicious payload.

Low

SKILL.md:22-37

Hidden Configuration File Access

The skill checks project and home EXTEND.md paths under .baoyu-skills for optional preferences. This is a bounded configuration lookup, but users should know it may read formatter preferences from hidden directories.

The documented paths are narrow and preference-oriented, so this is not secret harvesting. It is still a hidden-file access pattern worth disclosing.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/autocorrect.ts:1-5 scripts/main.ts:155-156

Shell Command Injection Through File Path

scripts/autocorrect.ts imports child_process and passes a template string to execSync. The file path comes from the CLI argument flow in scripts/main.ts, so a crafted path containing quotes or shell metacharacters can break out of the quoted argument and run arbitrary shell commands.

The code directly interpolates a user-supplied file path into an execSync shell command. Quoting the path does not prevent injection when the value can contain quote characters.

Medium

SKILL.md:212-214 scripts/autocorrect.ts:5

Unpinned External Tool Execution

The workflow instructs users to run npx with bun and the script invokes npx autocorrect-node. This executes external tooling without a pinned package version in the documented command path, creating supply-chain and reproducibility risk.

The external execution path is explicit and repeatable. The finding is not evidence of malware, but unpinned npx execution is a real marketplace risk.

Medium

scripts/main.ts:102-108 SKILL.md:99-101

In-Place File Modification

scripts/main.ts reads and writes the target file directly, and the skill also offers a typography-only mode that modifies the original file. This is expected formatter behavior, but it can overwrite user content if the wrong path is supplied or backup handling is bypassed.

The file read and write behavior is clear in the implementation and documentation. It is legitimate for a formatter, but it has user-data impact.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:3 SKILL.md:66-71 SKILL.md:218-226

Static Analyzer False Positives in Markdown Text

Most SKILL.md external command findings are Markdown examples, inline code, tables, and fenced commands that document formatter usage. The weak cryptography and reconnaissance alerts did not correspond to cryptographic operations or system probing in the reviewed file.

Line-number review shows documentation content and Markdown syntax, not executable code for cryptography or reconnaissance. The safe interpretation is supported by the surrounding workflow text.

Risk Factors

⚙️ External commands (4)

scripts/autocorrect.ts:1 scripts/autocorrect.ts:5 SKILL.md:212-214 SKILL.md:230-241

📁 Filesystem access (4)

scripts/main.ts:1 scripts/main.ts:102-108 SKILL.md:99-101 SKILL.md:181-190

Detected Patterns

execSync With Interpolated ArgumentDirect Write To User-Supplied Path

Audited by: codex

Audit version 1

Feb 17, 2026, 08:56 AM

Security evaluation confirms this is a legitimate markdown formatting skill. Static findings flagged external command execution (autocorrect-node), filesystem operations, and npm package URLs. All are false positives: execSync runs a known typography tool with CLI-provided paths, file I/O is scoped to user-specified files, and network access is limited to standard npm package downloads.

Files scanned

1,631

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/package-lock.json:409 scripts/package-lock.json:590

Weak Cryptographic Hashes in package-lock.json

SHA-1 hashes detected in npm package-lock.json. These are standard npm integrity verification hashes, not cryptographic vulnerabilities in the skill code.

Standard npm package-lock.json SHA-1 integrity hashes for package verification - not a security vulnerability in the skill itself.

Low

scripts/quotes.ts:3-4

Unicode Escape Sequences in quotes.ts

Unicode escape sequences used for curly quote characters. Legitimate character encoding for typography.

Standard Unicode escape sequences for curly quotes (U+201C, U+201D) - legitimate typography character encoding.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/autocorrect.ts:5

External Command Execution in autocorrect.ts

execSync used to run npx autocorrect-node. This is a legitimate typography tool call, not command injection. The filePath argument comes from CLI input and is enclosed in quotes, minimizing injection risk.

This is a false positive - execSync runs a known typography tool (autocorrect-node) with hardcoded command structure. The file path argument is properly quoted.

Medium

scripts/main.ts:102 scripts/main.ts:108

Synchronous File Operations

readFileSync and writeFileSync used for file I/O. This is standard synchronous file handling for a formatter tool, not a security issue.

Standard file I/O operations for reading/writing markdown files - legitimate behavior for a formatting utility.

Low

scripts/package-lock.json:45

NPM Registry URLs in package-lock.json

Hardcoded npm registry URLs for package dependencies. Standard npm behavior for package management.

Standard npm package registry URLs - normal package dependency references, not suspicious network behavior.

Risk Factors

⚙️ External commands (93)

scripts/autocorrect.ts:1 scripts/autocorrect.ts:5 scripts/autocorrect.ts:5 scripts/main.ts:115 scripts/main.ts:118 scripts/main.ts:144-153 scripts/main.ts:163 SKILL.md:12 SKILL.md:12 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:24-30 SKILL.md:30-66 SKILL.md:66-67 SKILL.md:67 SKILL.md:67 SKILL.md:67-68 SKILL.md:68 SKILL.md:68-69 SKILL.md:69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-86 SKILL.md:86-102 SKILL.md:102-112 SKILL.md:112-121 SKILL.md:121-127 SKILL.md:127-128 SKILL.md:128 SKILL.md:128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130 SKILL.md:130 SKILL.md:130-135 SKILL.md:135-136 SKILL.md:136-142 SKILL.md:142-144 SKILL.md:144-150 SKILL.md:150-168 SKILL.md:168 SKILL.md:168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170 SKILL.md:170-171 SKILL.md:171 SKILL.md:171 SKILL.md:171 SKILL.md:171 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:183 SKILL.md:186 SKILL.md:186 SKILL.md:187 SKILL.md:187 SKILL.md:190 SKILL.md:195 SKILL.md:197-203 SKILL.md:203-206 SKILL.md:206 SKILL.md:206-212 SKILL.md:212-214 SKILL.md:214-220 SKILL.md:220 SKILL.md:220 SKILL.md:220-221 SKILL.md:221-222 SKILL.md:222 SKILL.md:222-223 SKILL.md:223-224 SKILL.md:224 SKILL.md:224-225 SKILL.md:225-226 SKILL.md:226 SKILL.md:226-230 SKILL.md:230-242 SKILL.md:242-247 SKILL.md:247 SKILL.md:247-252 SKILL.md:252-262 SKILL.md:262-267 SKILL.md:267-269 SKILL.md:269-272 SKILL.md:272-286 SKILL.md:286-287 SKILL.md:287-292 SKILL.md:292 SKILL.md:201 SKILL.md:197-203

📁 Filesystem access (6)

scripts/main.ts:1 scripts/main.ts:1 scripts/main.ts:102 scripts/main.ts:108 SKILL.md:29 SKILL.md:37

🌐 Network access (91)

Audited by: claude

← Back to Skill