Audit History
minimal-run-and-audit - 7 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v7 Latest | Aug 8, 2026, 08:54 AM | 1 confirmed | 3 | Filesystem access |
| v6 | Jul 9, 2026, 03:06 PM | No confirmed findings | 1 | No capability change |
| v5 | Jul 9, 2026, 03:06 PM | No confirmed findings | 1 | No capability change |
| v4 | Jul 5, 2026, 08:24 PM | No confirmed findings | 1 | No capability change |
| v3 | Jul 5, 2026, 08:24 PM | No confirmed findings | 1 | Contains scripts |
| v2 | Jun 30, 2026, 07:33 AM | No confirmed findings | 2 | Contains scripts |
| v1 | Apr 9, 2026, 08:41 AM | No confirmed findings | 1 | Baseline |
Aug 8, 2026, 08:54 AM
The runner intentionally executes a user-supplied command, which is a confirmed high-risk capability despite avoiding shell interpretation. Two parent-directory references cross the audited package boundary, and the output wrapper dynamically executes a Python module; Markdown backticks and reporting text are false positives.
Confirmed security concerns (1)
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (11)
📁 Filesystem access (2)
Jul 9, 2026, 03:06 PM
Most static findings are false positives from Markdown backticks, reporting guidance, or fixed git status calls. One high-risk finding is confirmed because scripts/run_command.py executes a user-supplied command in a target repository. No prompt injection or additional semantic intent issue was found in the reviewed files.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (7)
Jul 9, 2026, 03:06 PM
Most static findings are false positives from Markdown backticks, reporting guidance, or fixed git status calls. One high-risk finding is confirmed because scripts/run_command.py executes a user-supplied command in a target repository. No prompt injection or additional semantic intent issue was found in the reviewed files.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (7)
Jul 5, 2026, 08:24 PM
Most static findings are documentation or reporting false positives. The confirmed issue is free-form command execution through --command in scripts/run_command.py. This is expected for the skill, but requires explicit trust and user control.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (7)
Jul 5, 2026, 08:24 PM
Most static findings are documentation or reporting false positives. The confirmed issue is free-form command execution through --command in scripts/run_command.py. This is expected for the skill, but requires explicit trust and user control.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (7)
Jun 30, 2026, 07:33 AM
Static analysis reported weak crypto, shell backtick, reconnaissance, and subprocess patterns. Review found the weak crypto, backtick, and reconnaissance hits are false positives from Markdown text, descriptions, or status messages, while the subprocess runner is intentional but risky. The skill is not blocked, but it should publish with a warning because it executes a user-selected local command.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚡ Contains scripts (2)
⚙️ External commands (4)
Detected Patterns
Apr 9, 2026, 08:41 AM
Static analysis flagged 16 patterns, but 15 are false positives from misidentified file types (markdown docs flagged as Ruby, YAML config flagged as crypto). One true positive: Python subprocess.run for command execution is legitimate and properly sandboxed with timeout handling and shlex parsing. External command execution is the intended function of this skill.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.