Versioned security assessment

Report ID: SA-42FB395E

6/30/2026, 6:19:09 AM

protocolsio-integration security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
protocolsio-integration
Version
v5
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/protocolsio-integration
Coverage
7 Files scanned · 2,138 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but review found Markdown API examples rather than bundled executable malware. The real risk is legitimate but elevated: the skill teaches authenticated network calls that can create, publish, delete, upload, download, and export protocols.io data.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 2,138 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:36-48references/protocols_api.md:97-105references/protocols_api.md:153-155references/protocols_api.md:183-185
Authenticated Remote Data Modification
The skill documents authenticated protocols.io operations that create protocols, add steps, publish protocols, and delete protocol steps. These are legitimate API workflows, but running them with real tokens can alter or publish remote research records.
The referenced lines directly describe authenticated token use and write, publish, or delete endpoints. This is a clear operational risk, but the context is documented protocols.io integration rather than concealed malicious behavior.
RISK-002 Medium
references/file_manager.md:86-92references/file_manager.md:122-124references/file_manager.md:213-217references/additional_features.md:264-268
Sensitive Workspace File and Export Operations
The file and organization workflows include uploading local files, downloading workspace files, deleting folders, and exporting organization data with files and comments. These actions can expose or alter sensitive research data if used with broad permissions.
The evidence shows concrete upload, download, delete, and export examples. The risk depends on user authorization and chosen identifiers, so it is elevated but not malicious by itself.
RISK-003 Medium
references/authentication.md:5-13references/authentication.md:52-69references/authentication.md:73-83references/authentication.md:96-100
OAuth Tokens Grant Private Content Access
The authentication guidance explains tokens that access private content, client secrets, refresh tokens, and bearer authorization headers. Mishandling these values could expose private protocols or workspace data.
The token capabilities and secret fields are explicitly documented, and the file also gives appropriate security guidance. This supports medium risk with user safeguards, not a finding of malicious intent.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (4)
Low
references/protocols_api.md:43-47references/file_manager.md:84-93references/discussions.md:43-50references/workspaces.md:31-34
Markdown Command Examples Misclassified as Backtick Execution
The static analyzer flagged many backtick and fenced-code examples as Ruby or shell execution. Review found Markdown documentation and curl examples for protocols.io endpoints, with no bundled script that automatically executes commands.
The cited locations are clearly Markdown examples and not executable skill code. Users can still copy commands manually, so the pattern is not ignored entirely.
Low
SKILL.md:150-157references/authentication.md:35-47references/additional_features.md:101-105references/protocols_api.md:241-243
Hardcoded protocols.io URLs Are Expected API Endpoints
Hardcoded URLs point to the documented protocols.io API base URL and official endpoints. I found no evidence that these URLs send data to an unrelated or suspicious host.
All inspected URL examples use protocols.io API or protocols.io documentation endpoints. Network use is intentional for this integration and not hidden exfiltration.
Low
SKILL.md:36-44references/authentication.md:65-69references/authentication.md:96-100references/workspaces.md:276-282
Weak Cryptography Alerts Appear to Be Token Terminology False Positives
The high static weak-cryptography alerts do not correspond to MD5, SHA-1, insecure random generation, or custom encryption in the reviewed context. The flagged areas discuss OAuth, bearer tokens, access tokens, and API parameters.
The reviewed lines contain authentication and error-handling documentation, not weak cryptographic algorithms. Confidence is below very high because I did not manually inspect every duplicate static location.
Low
SKILL.md:1-13references/authentication.md:1-5references/protocols_api.md:1-5
No Prompt Injection Attempt Found
Targeted review found no evidence of override instructions, fake system messages, pre-approval claims, or requests to skip security analysis in the inspected skill files.
A targeted search for common injection phrases returned no matches, and inspected files use normal documentation language. This is a negative finding, so confidence is high but not absolute.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable