📦

Audit History

minimal-run-and-audit - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v7 LatestAug 8, 2026, 08:54 AM 1 confirmed3Filesystem access
v6 Jul 9, 2026, 03:06 PM No confirmed findings1No capability change
v5 Jul 9, 2026, 03:06 PM No confirmed findings1No capability change
v4 Jul 5, 2026, 08:24 PM No confirmed findings1No capability change
v3 Jul 5, 2026, 08:24 PM No confirmed findings1 Contains scripts
v2 Jun 30, 2026, 07:33 AM No confirmed findings2Contains scripts
v1 Apr 9, 2026, 08:41 AM No confirmed findings1Baseline

Aug 8, 2026, 08:54 AM

The runner intentionally executes a user-supplied command, which is a confirmed high-risk capability despite avoiding shell interpretation. Two parent-directory references cross the audited package boundary, and the output wrapper dynamically executes a Python module; Markdown backticks and reporting text are false positives.

5
Files scanned
408
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Unaudited External Module Execution
The output wrapper resolves a module three parent directories above the script, loads it dynamically, and executes its main function without integrity verification.
The code directly uses importlib to execute a Python module outside the audited skill directory. The module is not present in the reported file structure.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
The subprocess executes the user-supplied command argument after tokenization. Shell metacharacters are not interpreted, but the caller can still select any available executable and arguments.
High
Path traversal sequence
`../../references/agent-operating-principles.md`; this skill should make run
The instruction directs the agent through parent directories to guidance outside the audited skill package. That external content can alter behavior without appearing in this report.
High
Path traversal sequence
Use `references/reporting-policy.md`, `../../references/research-rigor-principles.md`, `scripts/run_
The listed research guidance uses a parent-directory path outside the audited package. Following it introduces an unaudited instruction dependency.
Audited by: codex

Jul 9, 2026, 03:06 PM

Most static findings are false positives from Markdown backticks, reporting guidance, or fixed git status calls. One high-risk finding is confirmed because scripts/run_command.py executes a user-supplied command in a target repository. No prompt injection or additional semantic intent issue was found in the reviewed files.

5
Files scanned
384
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
execute_command runs the CLI supplied --command inside the target repository. Although shlex.split and a timeout reduce shell injection risk, this still allows arbitrary local command execution by design.
Audited by: codex

Jul 9, 2026, 03:06 PM

Most static findings are false positives from Markdown backticks, reporting guidance, or fixed git status calls. One high-risk finding is confirmed because scripts/run_command.py executes a user-supplied command in a target repository. No prompt injection or additional semantic intent issue was found in the reviewed files.

5
Files scanned
384
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
execute_command runs the CLI supplied --command inside the target repository. Although shlex.split and a timeout reduce shell injection risk, this still allows arbitrary local command execution by design.
Audited by: codex

Jul 5, 2026, 08:24 PM

Most static findings are documentation or reporting false positives. The confirmed issue is free-form command execution through --command in scripts/run_command.py. This is expected for the skill, but requires explicit trust and user control.

5
Files scanned
384
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
execute_command runs subprocess.run on a command supplied through --command in the target repo. It avoids shell=True, but still permits arbitrary external process execution if invoked on untrusted input.
Audited by: codex

Jul 5, 2026, 08:24 PM

Most static findings are documentation or reporting false positives. The confirmed issue is free-form command execution through --command in scripts/run_command.py. This is expected for the skill, but requires explicit trust and user control.

5
Files scanned
384
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Python subprocess.run
result = subprocess.run(
execute_command runs subprocess.run on a command supplied through --command in the target repo. It avoids shell=True, but still permits arbitrary external process execution if invoked on untrusted input.
Audited by: codex

Jun 30, 2026, 07:33 AM

Static analysis reported weak crypto, shell backtick, reconnaissance, and subprocess patterns. Review found the weak crypto, backtick, and reconnaissance hits are false positives from Markdown text, descriptions, or status messages, while the subprocess runner is intentional but risky. The skill is not blocked, but it should publish with a warning because it executes a user-selected local command.

5
Files scanned
384
Lines analyzed
4
Review items
1
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
User-Selected Local Command Execution
The runner accepts a command from the caller and executes it in the target repository with subprocess.run. It uses shlex.split and does not enable a shell, which lowers injection risk, but the selected command can still run arbitrary local tools or repository code.
The subprocess call and command argument are explicit. The risk is real but bounded by the skill purpose and by avoiding shell=True.
Low
Repository Path Metadata Collection
The script runs git status before and after execution and reports changed, new, deleted, and touched paths. This is useful audit evidence, but it may expose repository file names in generated reports.
The git status collection and path reporting are directly visible. The impact is limited to path metadata and supports the stated audit workflow.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Pattern False Positives
The weak crypto, Ruby backtick, and reconnaissance findings are not confirmed security issues. The cited lines contain Markdown code formatting, descriptions, or status text rather than cryptographic algorithms, Ruby execution, or system reconnaissance commands.
The cited lines were reviewed in context and do not perform the flagged operations. They are documentation or user-facing strings.

Detected Patterns

subprocess.run On Caller-Provided Commandsubprocess.run For Git Status Probes
Audited by: codex

Apr 9, 2026, 08:41 AM

Static analysis flagged 16 patterns, but 15 are false positives from misidentified file types (markdown docs flagged as Ruby, YAML config flagged as crypto). One true positive: Python subprocess.run for command execution is legitimate and properly sandboxed with timeout handling and shlex parsing. External command execution is the intended function of this skill.

5
Files scanned
384
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
External Command Execution
Script executes user-provided commands via subprocess.run with shlex.split parsing. Commands run with timeout protection (default 60s) and capture stdout/stderr. Risk is mitigated by timeout limits and lack of shell=True flag.
subprocess.run is called with split_command output (shlex.split), no shell=True, and timeout enforcement - legitimate command execution pattern

Risk Factors

Audited by: claude