Skills minimal-run-and-audit
๐Ÿ“ฆ

minimal-run-and-audit

Content revision r2 High Risk โš™๏ธ External commands๐Ÿ“ Filesystem access

Run and Audit Reproduction Commands

Short reproduction runs often produce inconsistent evidence and unclear results. This skill executes a selected command and organizes outcomes, metrics, logs, and repository changes.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "minimal-run-and-audit" from https://skillstore.io/skills/lllllllama-minimal-run-and-audit.md and its manifest at https://skillstore.io/api/skills/lllllllama-minimal-run-and-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "minimal-run-and-audit". Run the documented CPU smoke test with a 60 second timeout.

Expected outcome:

Status: successful. The command completed within the limit, produced one accuracy metric, and created no repository changes.

Using "minimal-run-and-audit". Run the evaluation command and record why it stops.

Expected outcome:

Status: blocked. The executable was unavailable, so no evaluation metric was observed and no files changed.

Using "minimal-run-and-audit". Audit a command that exceeds the allowed runtime.

Expected outcome:

Status: partial. The command timed out after the configured limit, and the available output was retained for review.

Security Audit

High Risk
v7 โ€ข 8/8/2026 Open versioned report

The runner intentionally executes a user-supplied command, which is a confirmed high-risk capability despite avoiding shell interpretation. Two parent-directory references cross the audited package boundary, and the output wrapper dynamically executes a Python module; Markdown backticks and reporting text are false positives.

5
Files scanned
408
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Unaudited External Module Execution
The output wrapper resolves a module three parent directories above the script, loads it dynamically, and executes its main function without integrity verification.
The code directly uses importlib to execute a Python module outside the audited skill directory. The module is not present in the reported file structure.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
The subprocess executes the user-supplied command argument after tokenization. Shell metacharacters are not interpreted, but the caller can still select any available executable and arguments.
High
Path traversal sequence
`../../references/agent-operating-principles.md`; this skill should make run
The instruction directs the agent through parent directories to guidance outside the audited skill package. That external content can alter behavior without appearing in this report.
High
Path traversal sequence
Use `references/reporting-policy.md`, `../../references/research-rigor-principles.md`, `scripts/run_
The listed research guidance uses a parent-directory path outside the audited package. Following it introduces an unaudited instruction dependency.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/lllllllama-minimal-run-and-audit/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/lllllllama-minimal-run-and-audit/security.svg)](https://skillstore.io/skills/lllllllama-minimal-run-and-audit?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/lllllllama-minimal-run-and-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lllllllama-minimal-run-and-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/lllllllama-minimal-run-and-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

lllllllama. (2026). minimal-run-and-audit security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lllllllama-minimal-run-and-audit/audits/7

BibTeX citation

@techreport{lllllllama-lllllllama-minimal-run-and-audit-2026, author = {lllllllama}, title = {minimal-run-and-audit security audit report (audit version 7)}, institution = {Skillstore}, year = {2026}, number = {7}, url = {https://skillstore.io/skills/lllllllama-minimal-run-and-audit/audits/7}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "minimal-run-and-audit security audit report (audit version 7)" version: "unspecified" type: report authors: - name: "lllllllama" date-released: "2026-08-08" url: "https://skillstore.io/skills/lllllllama-minimal-run-and-audit/audits/7" identifiers: - type: other value: "skillstore:lllllllama-minimal-run-and-audit:audit:7" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
64
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Verify a documented inference command

Run a repository inference example and capture its outcome, logs, metrics, and file changes.

Audit a reproduction smoke test

Produce concise evidence showing whether a selected smoke test succeeded, failed, or timed out.

Normalize evaluation evidence

Convert a short evaluation attempt into consistent artifacts for team review and comparison.

Try These Prompts

Run a smoke test
Run the selected smoke command in [repository path] with a [timeout] second limit. Report the outcome and captured evidence.
Audit an inference example
Execute [inference command] in [repository path]. Capture logs, numeric metrics, timeout state, and repository changes without modifying scientific behavior.
Compare an evaluation result
Run [evaluation command] and compare the observed metric with [expected baseline]. Mark unsupported comparisons and document any changed files.
Audit a patched reproduction
Execute [command] after the approved patches. Separate execution facts from inferences and document patch effects, comparability limits, metrics, and blockers.

Best Practices

  • Confirm the exact command, repository path, and timeout before execution.
  • Use short documented inference, evaluation, smoke, or sanity commands.
  • Review reported file changes and disclose any effect on scientific meaning.

Avoid

  • Do not use this skill to start training or resume long-running jobs.
  • Do not treat extracted metrics as validated scientific conclusions.
  • Do not hide preprocessing, checkpoint, evaluation, or metric changes.

Frequently Asked Questions

What commands can this skill run?
It can run a selected executable with arguments. Use it only for short, trusted, non-training verification commands.
Does it use a shell?
The runner tokenizes the command and launches the executable directly. Shell operators and expansions are not interpreted.
How are metrics collected?
It scans command output for named numeric values and selects a likely primary metric.
How are file changes detected?
It compares Git status snapshots taken before and after the command.
Can it run model training?
No. The skill explicitly excludes training startup, resume operations, and long-running training state.
Does it prove reproduction success?
No. It records execution evidence and comparability limits, but scientific validation still requires expert review.

Developer Details

Author

lllllllama

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

656be3040aef5c047555a908cd5c695d22a4a548

Maintenance freshness

8/8/2026

Usage

10 downloads ยท 105 views

File structure

๐Ÿ“ agents/

๐Ÿ“„ openai.yaml

๐Ÿ“ references/

๐Ÿ“„ reporting-policy.md

๐Ÿ“ scripts/

๐Ÿ“„ run_command.py

๐Ÿ“„ write_outputs.py

๐Ÿ“„ SKILL.md

More from lllllllama

View all
View all