Versioned security assessment

Report ID: SA-656BE304

8/8/2026, 8:29:08 AM

ai-research-explore security assessment v7

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
ai-research-explore
Version
v7
Maintainer
lllllllama
Source
github.com/lllllllama/rigorpilot-skills/tree/main/skills/ai-research-explore/
Coverage
34 Files scanned · 7,734 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives caused by Markdown formatting, identifiers, nested Python structures, and fixed argument-list subprocess calls. Confirmed risks include outbound lookup traffic, unrestricted user-derived URLs, and instructions to read files outside the skill package. Automatic imports execute target repository modules during feasibility checks, creating an unsandboxed arbitrary code execution risk.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

34 Files scanned · 7,734 Lines analyzed

18 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 12 evidence locations

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Observed in 8 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (16)
High
scripts/lookup/providers/base.py:61
Python HTTP libraries
request = urllib.request.Request(
The request accepts user-derived HTTP URLs without a host allowlist or private-address checks. This creates an SSRF-capable request path.
High
scripts/lookup/providers/base.py:68
Python HTTP libraries
with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT_SECONDS) as response:
urlopen sends requests to user-derived URLs without blocking loopback, private, or metadata addresses. This enables server-side request forgery.
High
SKILL.md:21
Path traversal sequence
`../../references/agent-operating-principles.md`, then load
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:22
Path traversal sequence
`../../references/research-rigor-principles.md` for research claims and
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:23
Path traversal sequence
`../../references/deep-learning-experiment-principles.md` when experiment
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:116
Path traversal sequence
- Load `../../references/explore-variant-spec.md` for run-level variant matrix
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:118
Path traversal sequence
- Load `../../references/research-thinking-loop.md` before proposing or ranking candidate changes; i
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:119
Path traversal sequence
- Load `../../references/research-rigor-principles.md` before making novelty, contribution, SOTA, or
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:120
Path traversal sequence
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:121
Path traversal sequence
- Load `../../references/deep-learning-experiment-principles.md` when training,
The instruction explicitly reads ../../references, crossing the audited skill boundary. External content can influence agent behavior without being included in this package audit.
High
SKILL.md:120
Hidden file in home directory
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The skill directs the agent to read a hidden file from the user's home directory. That is cross-boundary access to potentially sensitive local content.
Medium
SKILL.md:120
Hidden file access
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The instruction accesses ~/.rigorpilot/PERSONAL_RIGOR.md outside the skill and workspace. Advisory use still exposes local content to the agent context.
Low
scripts/lookup/providers/arxiv_provider.py:36
Hardcoded URL
f"https://export.arxiv.org/api/query?id_list={urllib.parse.quote(arxiv_id)}",
The provider performs an intended metadata lookup against export.arxiv.org. This is real network egress, although the identifier is encoded and no secret is sent.
Low
scripts/lookup/providers/doi_provider.py:36
Hardcoded URL
f"https://doi.org/{urllib.parse.quote(doi, safe='/')}",
The provider performs an intended metadata lookup against doi.org. This is real network egress, although the identifier is encoded and no secret is sent.
Low
scripts/lookup/providers/github_provider.py:23
Hardcoded URL
payload = http_get_json(f"https://api.github.com/repos/{owner}/{repo}/readme")
The provider performs an intended metadata lookup against api.github.com. This is real network egress to a fixed public host without credential transmission.
Low
scripts/lookup/providers/github_provider.py:67
Hardcoded URL
payload = http_get_json(f"https://api.github.com/repos/{owner}/{repo}")
The provider performs an intended metadata lookup against api.github.com. This is real network egress to a fixed public host without credential transmission.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical
scripts/passes/execution_feasibility.py:267-278scripts/passes/execution_feasibility.py:332-340
Automatic Target Repository Code Execution
Feasibility checks import selected Python files from the target repository. Module top-level code executes automatically, twice, without sandboxing or explicit execution consent.
spec.loader.exec_module directly executes repository modules during routine feasibility checks. Filename exclusions do not prevent malicious top-level code in other Python files.
RISK-002 High
scripts/write_outputs.py:10-16
Unaudited Cross-Package Module Execution
The output wrapper imports and executes a shared Python module located outside the audited skill directory. Package-relative trust is assumed without integrity verification.
The fixed relative path leaves the audited package and exec_module runs the external file. No hash, signature, or ownership validation is performed.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Feasibility checks execute target repository modules automatically.
    Replace runtime imports with AST inspection. If execution is essential, require consent and use an isolated process with restricted filesystem, network, and credentials.
  2. FIX-002
    High
    Generic source lookup accepts unrestricted HTTP targets.
    Allowlist public research hosts and reject loopback, private, link-local, metadata, credentialed, and redirect targets before every request.
  3. FIX-003
    High
    The output writer executes a module outside the audited package.
    Bundle the writer inside the skill or verify its immutable hash before import. Avoid executing code from mutable parent directories.
  4. FIX-004
    High
    Skill instructions read parent-directory references and a hidden home file.
    Package required references locally. Request explicit permission before reading personal files, and clearly identify every external path.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
656be3040aef5c047555a908cd5c695d22a4a548
Content hash
c72dd34367826f884ca18c455686caf25058e7287f6d3233d79da3bbca41d188
Tree hash
e123262ee6409d16e98bbff8e54b8f80870660c9d69eae56ea96b956a1c8d839
Skill path
skills/lllllllama/ai-research-explore
Audit payload hash
c9100a4ce9cbb3ce7cd250c4f7f7985a

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active