Versioned security assessment

Report ID: SA-656BE304

8/8/2026, 8:37:07 AM

ai-research-reproduction security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
ai-research-reproduction
Version
v5
Maintainer
lllllllama
Source
github.com/lllllllama/rigorpilot-skills/tree/main/skills/ai-research-reproduction/
Coverage
14 Files scanned · 2,038 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown backticks, prose, safe temporary-file handling, or fixed argument-array subprocess calls. Confirmed risks include executing README-derived commands, loading files outside the skill directory, accessing a hidden home file, and dynamically importing external sibling code.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

14 Files scanned · 2,038 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 9 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (9)
High
scripts/orchestrate_repro.py:357
Python subprocess.run
result = subprocess.run(
This executes a command extracted from an untrusted target repository README. The opt-in flag limits surprise, but there is no allowlist, sandbox, or final command approval.
High
SKILL.md:20
Path traversal sequence
`../../references/agent-operating-principles.md`, then load
The skill instructs the agent to load a path two directories above its package. This expands the trust boundary beyond marketplace-audited files.
High
SKILL.md:21
Path traversal sequence
`../../references/research-rigor-principles.md` and
The required policy is resolved outside the skill directory. External content could alter behavior without changing this audited package.
High
SKILL.md:22
Path traversal sequence
`../../references/deep-learning-experiment-principles.md` when scientific meaning, comparability, or
This directs the agent to read an out-of-package experiment policy. The referenced content is outside the report's scanned file set.
High
SKILL.md:121
Path traversal sequence
- Load `../../references/research-rigor-principles.md` before making comparability, contribution, or
The instruction repeats an out-of-package policy read before research claims. The external file is not covered by this audit.
High
SKILL.md:122
Path traversal sequence
- Load `../../references/deep-learning-experiment-principles.md` when dataset, split, metric, checkp
The agent is told to load a policy through parent-directory traversal. This creates an unaudited instruction dependency.
High
SKILL.md:123
Path traversal sequence
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The line references both a home-directory file and a parent-relative external policy. These reads cross the packaged skill boundary.
High
SKILL.md:123
Hidden file in home directory
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The skill explicitly instructs the agent to consult a hidden user-home file. Its contents may be private and are not marketplace audited.
High
SKILL.md:123
Hidden file access
- Consult `~/.rigorpilot/PERSONAL_RIGOR.md` if present, under `../../references/continuous-learning-
The requested hidden-file read introduces user-specific, unaudited instructions into the agent context. Explicit consent and scope controls are absent.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
scripts/orchestrate_repro.py:23-31
Unaudited Dynamic Module Execution
The orchestrator resolves a sibling lessons_store.py outside the skill package and executes it through importlib without provenance or integrity verification.
The code directly constructs an out-of-package path and calls exec_module. The external module is not included in the scanned file set.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    A documented command extracted from an untrusted repository can execute with the agent process permissions.
    Show the exact command and working directory, require immediate approval, and run it in a restricted container without secrets or host write access.
  2. FIX-002
    High
    The skill directs agents to load policies outside its package and consult a hidden file in the user home directory.
    Bundle required policies inside the skill, enforce skill-root path containment, and require explicit consent before reading user-specific files.
  3. FIX-003
    High
    The orchestrator dynamically imports and executes a sibling lessons module without verifying its integrity.
    Use a packaged dependency with a pinned integrity check, or remove dynamic loading and expose lesson recording through a trusted API.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
656be3040aef5c047555a908cd5c695d22a4a548
Content hash
2dd32f685ef0b2154ab960ba06548e675cbd4533fbf4499518f98d9bd2607bc3
Tree hash
ae2e707197dad62a5bce67ff854dfd1093d46586831bad4055e2ed523257cae0
Skill path
skills/lllllllama/ai-research-reproduction
Audit payload hash
0e6e362c1e05c842354d2126b7f91ca1

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active