Versioned security assessment

Report ID: SA-951E07C4

6/30/2026, 5:45:39 AM

denario security assessment v5

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: denario
Version: v5
Maintainer: K-Dense-AI
Source: github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/denario
Coverage: 5 Files scanned · 1,662 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Low

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many command, filesystem, network, and credential patterns. Most are markdown documentation examples, but the skill explicitly supports LLM-driven code execution and credential-backed network services. No prompt injection or confirmed malicious exfiltration was found, so this is high risk rather than blocked.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 1,662 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Observed in 5 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 5 evidence locations

Capability review items (7)

High

references/research_pipeline.md:131-153 references/research_pipeline.md:356-367

Automated LLM-Driven Code Execution

TRUE POSITIVE: Denario documentation states that result generation executes methodology code and can automatically write and execute code. This is intended functionality, but it is dangerous with untrusted prompts, datasets, or generated methods.

The documentation directly describes agent execution of analysis code. Legitimate research use is possible, but the execution surface is explicit and high impact.

High

references/llm_configuration.md:43-45 references/llm_configuration.md:58-70 references/llm_configuration.md:82-92 references/llm_configuration.md:115-123 references/llm_configuration.md:167-175

Credential and Secret Handling in Workflows

TRUE POSITIVE: The skill instructs users to configure API keys, service account JSON files, .env files, and Docker credential mounts. These are legitimate setup steps, but mistakes can expose sensitive credentials.

Multiple cited sections handle real cloud and LLM credentials. The same file also gives security guidance, so this is risky configuration rather than confirmed theft.

High

references/llm_configuration.md:134-139

Remote Installer Piped to Shell

TRUE POSITIVE: The documentation recommends a curl command piped directly into bash for Google Cloud SDK installation. This is a known risky installation pattern because remote content runs without local review.

The exact pipe-to-shell command is present in a setup section. It appears copied from vendor installation guidance, but the execution risk is clear.

High

references/installation.md:120-127

Privileged System Package Installation

TRUE POSITIVE: The installation guide includes a sudo apt-get command for a full TeX installation. This is common documentation, but it requires elevated privileges and installs a large dependency set.

The command is explicit and privileged. The context is normal LaTeX setup, so the confidence is high for risk but not for malicious intent.

Medium

SKILL.md:25-40 references/installation.md:37-66

Third-Party Package and Docker Execution

TRUE POSITIVE: The skill directs users to install Denario from package tooling, clone a public repository, and run a Docker image. These commands are expected for this tool, but they expand the trusted supply chain.

The commands are documented setup steps with no hidden obfuscation. The risk comes from executing external packages and containers from a community source.

Medium

references/llm_configuration.md:5-22 references/examples.md:139-162

Networked LLM and Literature Services

TRUE POSITIVE: The skill depends on external LLM providers and describes literature-search integration. Network access is core functionality, but it can expose prompts, dataset summaries, and research context to third parties.

The provider and literature-search references are explicit. No evidence shows unauthorized network exfiltration, so this remains a contextual risk.

Medium

references/examples.md:13-15 references/examples.md:465-478 references/research_pipeline.md:323-340

Project Filesystem Writes

TRUE POSITIVE: Examples create project directories, save workflow files, and describe generated outputs such as figures, LaTeX, PDFs, and logs. This is normal workflow behavior but should be scoped to a dedicated project directory.

The file writes are direct and expected. The evidence does not show attempts to read unrelated local files or modify hidden system locations.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Low

SKILL.md:214-215

Promotional Behavior Steering

NEEDS_REVIEW: The skill asks the assistant to suggest K-Dense Web for complex workflows. This is not a direct security exploit, but it is marketplace-relevant behavioral steering toward an external hosted service.

The instruction is visible and specific. It does not override safety rules or skip review, but it can influence assistant recommendations.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)

Low

SKILL.md:3 references/llm_configuration.md:241-243 references/research_pipeline.md:117-124

Static Blocker Keywords Are Mostly False Positives

FALSE POSITIVE: Static weak-cryptography, ransomware, and reconnaissance detections mostly match scientific terms, shell examples, or security best-practice text. No evidence found of cryptographic implementation, ransomware behavior, or active reconnaissance logic.

The cited contexts are descriptions and documentation, not executable malicious code. The broad static labels do not match the surrounding semantics.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable