📦
Audit History
vaex - 7 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v7 Latest | Jul 5, 2026, 05:32 PM | 2 confirmed | 2 | No capability change |
| v6 | Jul 5, 2026, 05:32 PM | 2 confirmed | 2 | Env variables |
| v5 | Jun 30, 2026, 06:23 AM | 2 confirmed | 1 | No capability change |
| v4 | Jan 17, 2026, 07:50 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 07:50 AM | No confirmed findings | 0 | Env variables |
| v2 | Jan 12, 2026, 04:46 PM | No confirmed findings | 0 | External commandsNetwork accessFilesystem accessEnv variables |
| v1 | Jan 5, 2026, 04:44 PM | No confirmed findings | 0 | Baseline |
Audit version 7 Latest
Jul 5, 2026, 05:32 PM
Most static findings are documentation false positives from Markdown backticks, Vaex memory-mapping terms, and data-analysis vocabulary. Confirmed risks are limited to insecure remote-server guidance and credential-handling examples. No evidence found of prompt injection, malware behavior, or automatic command execution.
7
Files scanned
3,725
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Credential JSON file
fs = gcsfs.GCSFileSystem(token='path/to/credentials.json')
The example points to a credential JSON file without storage or rotation guidance. Such files often contain long-lived cloud credentials and need safer handling.
Low
External Service Promotion in Runtime Instructions
SKILL.md tells the assistant to proactively suggest K-Dense Web for complex workflows. This can steer users toward a creator-operated external service outside the Vaex task.
The instruction appears directly in SKILL.md lines 181-182 and is unrelated to Vaex operation. It is transparent promotion, so severity is low.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
fs = s3fs.S3FileSystem(key='access_key', secret='secret_key')
The example demonstrates passing cloud access keys directly in code. The values are placeholders, but generated code could teach users to embed real secrets.
Medium
Hardcoded IP address
vaex-server data.hdf5 --host 0.0.0.0 --port 9000
The example binds Vaex server to 0.0.0.0 and documents remote access without auth or TLS guidance. If copied, it can expose datasets over the network.
Risk Factors
🌐 Network access (1)
📁 Filesystem access (15)
references/io_operations.md:10 references/io_operations.md:13 references/io_operations.md:22 references/io_operations.md:31 references/io_operations.md:39 references/io_operations.md:48 references/io_operations.md:422 references/io_operations.md:427 references/io_operations.md:433 references/io_operations.md:434 references/io_operations.md:692 references/io_operations.md:637 references/io_operations.md:221 references/performance.md:259 references/performance.md:262
🔑 Env variables (1)
⚙️ External commands (28)
SKILL.md:32 SKILL.md:40 SKILL.md:49 SKILL.md:51 SKILL.md:58 SKILL.md:66 SKILL.md:75 SKILL.md:86-114 SKILL.md:114-120 SKILL.md:120 SKILL.md:121-122 SKILL.md:122-123 SKILL.md:123-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-138 SKILL.md:138-149 SKILL.md:149-152 SKILL.md:152-160 SKILL.md:160-163 SKILL.md:163-168 SKILL.md:168-172 SKILL.md:172-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179
Audited by: codex
Jul 5, 2026, 05:32 PM
Most static findings are documentation false positives from Markdown backticks, Vaex memory-mapping terms, and data-analysis vocabulary. Confirmed risks are limited to insecure remote-server guidance and credential-handling examples. No evidence found of prompt injection, malware behavior, or automatic command execution.
7
Files scanned
3,725
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Credential JSON file
fs = gcsfs.GCSFileSystem(token='path/to/credentials.json')
The example points to a credential JSON file without storage or rotation guidance. Such files often contain long-lived cloud credentials and need safer handling.
Low
External Service Promotion in Runtime Instructions
SKILL.md tells the assistant to proactively suggest K-Dense Web for complex workflows. This can steer users toward a creator-operated external service outside the Vaex task.
The instruction appears directly in SKILL.md lines 181-182 and is unrelated to Vaex operation. It is transparent promotion, so severity is low.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
fs = s3fs.S3FileSystem(key='access_key', secret='secret_key')
The example demonstrates passing cloud access keys directly in code. The values are placeholders, but generated code could teach users to embed real secrets.
Medium
Hardcoded IP address
vaex-server data.hdf5 --host 0.0.0.0 --port 9000
The example binds Vaex server to 0.0.0.0 and documents remote access without auth or TLS guidance. If copied, it can expose datasets over the network.
Risk Factors
🌐 Network access (1)
📁 Filesystem access (15)
references/io_operations.md:10 references/io_operations.md:13 references/io_operations.md:22 references/io_operations.md:31 references/io_operations.md:39 references/io_operations.md:48 references/io_operations.md:422 references/io_operations.md:427 references/io_operations.md:433 references/io_operations.md:434 references/io_operations.md:692 references/io_operations.md:637 references/io_operations.md:221 references/performance.md:259 references/performance.md:262
🔑 Env variables (1)
⚙️ External commands (28)
SKILL.md:32 SKILL.md:40 SKILL.md:49 SKILL.md:51 SKILL.md:58 SKILL.md:66 SKILL.md:75 SKILL.md:86-114 SKILL.md:114-120 SKILL.md:120 SKILL.md:121-122 SKILL.md:122-123 SKILL.md:123-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-138 SKILL.md:138-149 SKILL.md:149-152 SKILL.md:152-160 SKILL.md:160-163 SKILL.md:163-168 SKILL.md:168-172 SKILL.md:172-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179
Audited by: codex
Jun 30, 2026, 06:23 AM
Static analysis reported many command-execution and blocker hits, but review found these are mostly Markdown fences, Vaex API examples, and placeholder filenames rather than executable skill code. The skill is documentation-only, but it includes cloud credential examples and a server command bound to 0.0.0.0, so publication should include a security warning.
7
Files scanned
3,725
Lines analyzed
6
Review items
1
False positives ignored
Confirmed security concerns (2)
Medium
Inline Cloud Credential Examples
The S3 and GCS examples show credentials passed directly in code or by credential JSON path. The values are placeholders, but copied patterns can lead users to expose secrets in prompts, notebooks, or repositories.
The cited lines directly document secret-bearing parameters and a credential file path. They are placeholders, so the issue is risky guidance rather than confirmed credential disclosure.
Medium
Remote Vaex Server Exposed on All Interfaces
The server example binds to 0.0.0.0 and then documents websocket access. Without authentication, TLS, and network restrictions, this can expose dataset access or computation to unintended clients.
The bind address and remote connection example are explicit. The documentation does not state an auth model, so risk depends on deployment context.
Needs review findings (1)
These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.
Low
State File Loading Requires Trusted Inputs
The references document saving and loading Vaex state JSON files. No malicious payload is present, but users should load state files only from trusted sources.
The lines show state serialization workflows, but no evidence shows unsafe deserialization or code execution. The residual risk is trust-boundary guidance.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Markdown Code Fences Misclassified as Shell Execution
Most external command alerts point to Markdown backticks and Python examples. They are static documentation snippets, not skill code that executes shell commands.
The matched content is documentation in Markdown code blocks. No executable wrapper, script, hook, or command dispatcher was found in the reviewed files.
Risk Factors
🌐 Network access (3)
📁 Filesystem access (3)
⚙️ External commands (1)
Detected Patterns
Credential Handling in DocumentationPublic Network Bind Example
Audited by: codex
Jan 17, 2026, 07:50 AM
This is a pure documentation skill for the Vaex Python library. All 498 static findings are false positives caused by markdown code block formatting. The scanner misinterpreted backticks in code examples as Ruby/shell commands, flagged memory-mapping as filesystem access, and misidentified DataFrame inspection methods as reconnaissance. No executable code, credential handling, or malicious patterns exist.
8
Files scanned
6,268
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (7)
📁 Filesystem access (3)
🌐 Network access (1)
Audited by: claude
Jan 17, 2026, 07:50 AM
This is a pure documentation skill for the Vaex Python library. All 498 static findings are false positives caused by markdown code block formatting. The scanner misinterpreted backticks in code examples as Ruby/shell commands, flagged memory-mapping as filesystem access, and misidentified DataFrame inspection methods as reconnaissance. No executable code, credential handling, or malicious patterns exist.
8
Files scanned
6,268
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (7)
📁 Filesystem access (3)
🌐 Network access (1)
Audited by: claude
Jan 12, 2026, 04:46 PM
This is a legitimate Vaex documentation skill containing only markdown reference files. All 492 static findings are false positives triggered by markdown code formatting (backticks misinterpreted as Ruby/shell commands), documentation text about algorithms, and legitimate library features like memory-mapping. No actual executable code, credential handling, or malicious patterns exist.
7
Files scanned
3,725
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (444)
references/core_dataframes.md:15 references/core_dataframes.md:19-31 references/core_dataframes.md:31-40 references/core_dataframes.md:40-54 references/core_dataframes.md:54-60 references/core_dataframes.md:60-70 references/core_dataframes.md:70-74 references/core_dataframes.md:74-86 references/core_dataframes.md:86-90 references/core_dataframes.md:90-100 references/core_dataframes.md:100-104 references/core_dataframes.md:104-114 references/core_dataframes.md:114-120 references/core_dataframes.md:120-129 references/core_dataframes.md:129-135 references/core_dataframes.md:135-152 references/core_dataframes.md:152-156 references/core_dataframes.md:156-171 references/core_dataframes.md:171-175 references/core_dataframes.md:175-188 references/core_dataframes.md:188-194 references/core_dataframes.md:194-211 references/core_dataframes.md:211-215 references/core_dataframes.md:215-226 references/core_dataframes.md:226-232 references/core_dataframes.md:232-243 references/core_dataframes.md:243-249 references/core_dataframes.md:249-255 references/core_dataframes.md:255-259 references/core_dataframes.md:259-266 references/core_dataframes.md:266-270 references/core_dataframes.md:270-277 references/core_dataframes.md:277-283 references/core_dataframes.md:283-284 references/core_dataframes.md:284-292 references/core_dataframes.md:292-298 references/core_dataframes.md:298-302 references/core_dataframes.md:302-315 references/core_dataframes.md:315-319 references/core_dataframes.md:319-327 references/core_dataframes.md:327-333 references/core_dataframes.md:333-337 references/core_dataframes.md:337-341 references/core_dataframes.md:341-347 references/core_dataframes.md:347-351 references/core_dataframes.md:351-361 references/core_dataframes.md:361-365 references/core_dataframes.md:365-366 references/core_dataframes.md:366-367 references/data_processing.md:11-21 references/data_processing.md:21-27 references/data_processing.md:27-44 references/data_processing.md:44-48 references/data_processing.md:48-63 references/data_processing.md:63-71 references/data_processing.md:71-84 references/data_processing.md:84-88 references/data_processing.md:88-111 references/data_processing.md:111-115 references/data_processing.md:115-128 references/data_processing.md:128-132 references/data_processing.md:132-136 references/data_processing.md:136-158 references/data_processing.md:158-162 references/data_processing.md:162-174 references/data_processing.md:174-178 references/data_processing.md:178-182 references/data_processing.md:182-201 references/data_processing.md:201-209 references/data_processing.md:209-225 references/data_processing.md:225-229 references/data_processing.md:229-264 references/data_processing.md:264-272 references/data_processing.md:272-285 references/data_processing.md:285-289 references/data_processing.md:289-303 references/data_processing.md:303-307 references/data_processing.md:307-317 references/data_processing.md:317-325 references/data_processing.md:325-334 references/data_processing.md:334-338 references/data_processing.md:338-347 references/data_processing.md:347-353 references/data_processing.md:353-364 references/data_processing.md:364-372 references/data_processing.md:372-380 references/data_processing.md:380-384 references/data_processing.md:384-395 references/data_processing.md:395-404 references/data_processing.md:404-410 references/data_processing.md:410-414 references/data_processing.md:414-424 references/data_processing.md:424-430 references/data_processing.md:430-447 references/data_processing.md:447-453 references/data_processing.md:453-464 references/data_processing.md:464-468 references/data_processing.md:468-477 references/data_processing.md:477-481 references/data_processing.md:481-490 references/data_processing.md:490-496 references/data_processing.md:496-503 references/data_processing.md:503-507 references/data_processing.md:507-512 references/data_processing.md:512-516 references/data_processing.md:516-523 references/data_processing.md:523-527 references/data_processing.md:527-539 references/data_processing.md:539-545 references/data_processing.md:545 references/data_processing.md:545-552 references/data_processing.md:552-553 references/data_processing.md:553-554 references/data_processing.md:554-555 references/io_operations.md:19-28 references/io_operations.md:28-38 references/io_operations.md:38-45 references/io_operations.md:45-55 references/io_operations.md:55-65 references/io_operations.md:65-79 references/io_operations.md:79-100 references/io_operations.md:100-104 references/io_operations.md:104-109 references/io_operations.md:109-115 references/io_operations.md:115-121 references/io_operations.md:121-133 references/io_operations.md:133-137 references/io_operations.md:137-143 references/io_operations.md:143-147 references/io_operations.md:147-154 references/io_operations.md:154-158 references/io_operations.md:158-173 references/io_operations.md:173-179 references/io_operations.md:179-192 references/io_operations.md:192-196 references/io_operations.md:196-202 references/io_operations.md:202-206 references/io_operations.md:206-212 references/io_operations.md:212-216 references/io_operations.md:216-229 references/io_operations.md:229-235 references/io_operations.md:235-254 references/io_operations.md:254-258 references/io_operations.md:258-266 references/io_operations.md:266-272 references/io_operations.md:272-284 references/io_operations.md:284-288 references/io_operations.md:288-299 references/io_operations.md:299-305 references/io_operations.md:305-319 references/io_operations.md:319-323 references/io_operations.md:323-334 references/io_operations.md:334-340 references/io_operations.md:340-351 references/io_operations.md:351-355 references/io_operations.md:355-363 references/io_operations.md:363-367 references/io_operations.md:367-370 references/io_operations.md:370-374 references/io_operations.md:374-381 references/io_operations.md:381-387 references/io_operations.md:387-404 references/io_operations.md:404-408 references/io_operations.md:408-420 references/io_operations.md:420-426 references/io_operations.md:426-435 references/io_operations.md:435-439 references/io_operations.md:439-444 references/io_operations.md:444-450 references/io_operations.md:450-457 references/io_operations.md:457-461 references/io_operations.md:461-466 references/io_operations.md:466-472 references/io_operations.md:472-475 references/io_operations.md:475-479 references/io_operations.md:479-487 references/io_operations.md:487-493 references/io_operations.md:493-502 references/io_operations.md:502-506 references/io_operations.md:506-514 references/io_operations.md:514-520 references/io_operations.md:520-531 references/io_operations.md:531-535 references/io_operations.md:535-541 references/io_operations.md:541-545 references/io_operations.md:545-551 references/io_operations.md:551-555 references/io_operations.md:555-561 references/io_operations.md:561-565 references/io_operations.md:565-575 references/io_operations.md:575-581 references/io_operations.md:581-603 references/io_operations.md:603-609 references/io_operations.md:609-626 references/io_operations.md:626-630 references/io_operations.md:630-638 references/io_operations.md:638-642 references/io_operations.md:642-655 references/io_operations.md:655-661 references/io_operations.md:661-665 references/io_operations.md:665-669 references/io_operations.md:669-673 references/io_operations.md:673-677 references/io_operations.md:677-685 references/io_operations.md:685-701 references/io_operations.md:701-702 references/io_operations.md:702-703 references/machine_learning.md:7 references/machine_learning.md:21-36 references/machine_learning.md:36-40 references/machine_learning.md:40-51 references/machine_learning.md:51-55 references/machine_learning.md:55-60 references/machine_learning.md:60-64 references/machine_learning.md:64-69 references/machine_learning.md:69-75 references/machine_learning.md:75-82 references/machine_learning.md:82-86 references/machine_learning.md:86-99 references/machine_learning.md:99-103 references/machine_learning.md:103-110 references/machine_learning.md:110-114 references/machine_learning.md:114-124 references/machine_learning.md:124-128 references/machine_learning.md:128-136 references/machine_learning.md:136-142 references/machine_learning.md:142-151 references/machine_learning.md:151-155 references/machine_learning.md:155-165 references/machine_learning.md:165-169 references/machine_learning.md:169-182 references/machine_learning.md:182-186 references/machine_learning.md:186-194 references/machine_learning.md:194-200 references/machine_learning.md:200-214 references/machine_learning.md:214-220 references/machine_learning.md:220-249 references/machine_learning.md:249-253 references/machine_learning.md:253-281 references/machine_learning.md:281-285 references/machine_learning.md:285-313 references/machine_learning.md:313-317 references/machine_learning.md:317-341 references/machine_learning.md:341-345 references/machine_learning.md:345-376 references/machine_learning.md:376-382 references/machine_learning.md:382-408 references/machine_learning.md:408-412 references/machine_learning.md:412-454 references/machine_learning.md:454-460 references/machine_learning.md:460-471 references/machine_learning.md:471-475 references/machine_learning.md:475-489 references/machine_learning.md:489-493 references/machine_learning.md:493-498 references/machine_learning.md:498-504 references/machine_learning.md:504-521 references/machine_learning.md:521-525 references/machine_learning.md:525-539 references/machine_learning.md:539-543 references/machine_learning.md:543-569 references/machine_learning.md:569-575 references/machine_learning.md:575-587 references/machine_learning.md:587-591 references/machine_learning.md:591-601 references/machine_learning.md:601-607 references/machine_learning.md:607-618 references/machine_learning.md:618-622 references/machine_learning.md:622-632 references/machine_learning.md:632-636 references/machine_learning.md:636-646 references/machine_learning.md:646-652 references/machine_learning.md:652-690 references/machine_learning.md:690-694 references/machine_learning.md:694-711 references/machine_learning.md:711-717 references/machine_learning.md:717-721 references/machine_learning.md:721-726 references/machine_learning.md:726-727 references/machine_learning.md:727-728 references/performance.md:11-23 references/performance.md:23-32 references/performance.md:32-43 references/performance.md:43-51 references/performance.md:51-66 references/performance.md:66-70 references/performance.md:70-89 references/performance.md:89-93 references/performance.md:93-99 references/performance.md:99-113 references/performance.md:113-121 references/performance.md:121-142 references/performance.md:142-146 references/performance.md:146-154 references/performance.md:154-162 references/performance.md:162-175 references/performance.md:175-179 references/performance.md:179-193 references/performance.md:193-197 references/performance.md:197-210 references/performance.md:210-218 references/performance.md:218-228 references/performance.md:228-232 references/performance.md:232-239 references/performance.md:239-243 references/performance.md:243-253 references/performance.md:253-261 references/performance.md:261-267 references/performance.md:267-271 references/performance.md:271-281 references/performance.md:281-285 references/performance.md:285-298 references/performance.md:298-306 references/performance.md:306-316 references/performance.md:316-320 references/performance.md:320-333 references/performance.md:333-341 references/performance.md:341-354 references/performance.md:354-358 references/performance.md:358-368 references/performance.md:368-374 references/performance.md:374-386 references/performance.md:386-390 references/performance.md:390-402 references/performance.md:402-406 references/performance.md:406-424 references/performance.md:424-428 references/performance.md:428-439 references/performance.md:439-443 references/performance.md:443-453 references/performance.md:453-459 references/performance.md:459-470 references/performance.md:470-474 references/performance.md:474-479 references/performance.md:479-483 references/performance.md:483-496 references/performance.md:496-502 references/performance.md:502-512 references/performance.md:512-516 references/performance.md:516-523 references/performance.md:523-527 references/performance.md:527-538 references/performance.md:538-542 references/performance.md:542-552 references/performance.md:552-562 references/performance.md:562 references/performance.md:562-569 references/performance.md:569-570 references/performance.md:570-571 references/visualization.md:20-38 references/visualization.md:38-42 references/visualization.md:42-57 references/visualization.md:57-61 references/visualization.md:61-70 references/visualization.md:70-76 references/visualization.md:76-91 references/visualization.md:91-95 references/visualization.md:95-106 references/visualization.md:106-110 references/visualization.md:110-119 references/visualization.md:119-125 references/visualization.md:125-140 references/visualization.md:140-144 references/visualization.md:144-170 references/visualization.md:170-176 references/visualization.md:176-194 references/visualization.md:194-198 references/visualization.md:198-210 references/visualization.md:210-216 references/visualization.md:216-232 references/visualization.md:232-236 references/visualization.md:236-250 references/visualization.md:250-258 references/visualization.md:258-261 references/visualization.md:261-265 references/visualization.md:265-268 references/visualization.md:268-272 references/visualization.md:272-275 references/visualization.md:275-281 references/visualization.md:281-305 references/visualization.md:305-309 references/visualization.md:309-314 references/visualization.md:314-320 references/visualization.md:320-329 references/visualization.md:329-333 references/visualization.md:333-350 references/visualization.md:350-354 references/visualization.md:354-378 references/visualization.md:378-384 references/visualization.md:384-393 references/visualization.md:393-397 references/visualization.md:397-413 references/visualization.md:413-419 references/visualization.md:419-429 references/visualization.md:429-433 references/visualization.md:433-443 references/visualization.md:443-449 references/visualization.md:449-489 references/visualization.md:489-493 references/visualization.md:493-515 references/visualization.md:515-519 references/visualization.md:519-534 references/visualization.md:534-540 references/visualization.md:540-550 references/visualization.md:550-554 references/visualization.md:554-564 references/visualization.md:564-580 references/visualization.md:580-587 references/visualization.md:587-591 references/visualization.md:591-597 references/visualization.md:597-601 references/visualization.md:601-607 references/visualization.md:607-611 references/visualization.md:611-612 references/visualization.md:612-613 SKILL.md:32 SKILL.md:40 SKILL.md:49 SKILL.md:51 SKILL.md:58 SKILL.md:66 SKILL.md:75 SKILL.md:86-114 SKILL.md:114-120 SKILL.md:120 SKILL.md:120-121 SKILL.md:121-122 SKILL.md:122-123 SKILL.md:123-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-138 SKILL.md:138-149 SKILL.md:149-152 SKILL.md:152-160 SKILL.md:160-163 SKILL.md:163-168 SKILL.md:168-172 SKILL.md:172-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179
🌐 Network access (1)
📁 Filesystem access (15)
references/io_operations.md:10 references/io_operations.md:13 references/io_operations.md:22 references/io_operations.md:31 references/io_operations.md:39 references/io_operations.md:48 references/io_operations.md:422 references/io_operations.md:427 references/io_operations.md:433 references/io_operations.md:434 references/io_operations.md:692 references/io_operations.md:637 references/io_operations.md:221 references/performance.md:259 references/performance.md:262
🔑 Env variables (1)
Audited by: claude
Jan 5, 2026, 04:44 PM
Pure documentation skill with no executable code. Contains only reference materials for the Vaex Python library. No security risks identified.
7
Files scanned
3,984
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude