Audit History
paper-context-resolver - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Aug 8, 2026, 08:58 AM | No confirmed findings | 0 | No capability change |
| v4 | Jul 6, 2026, 06:30 PM | No confirmed findings | 0 | No capability change |
| v3 | Jul 6, 2026, 06:30 PM | No confirmed findings | 0 | External commands |
| v2 | Jun 30, 2026, 07:35 AM | No confirmed findings | 0 | No capability change |
| v1 | Apr 9, 2026, 08:41 AM | No confirmed findings | 0 | Baseline |
Aug 8, 2026, 08:58 AM
Both static findings are false positives caused by Markdown backticks around a skill slug and a reference path in SKILL.md. No command execution, prompt injection, or other malicious intent was found.
Risk Factors
⚙️ External commands (2)
Jul 6, 2026, 06:30 PM
The static external command finding is a false positive. SKILL.md uses markdown backticks around a reference file path and does not instruct command execution. No prompt injection, data exfiltration intent, or malicious workflow behavior was found.
Risk Factors
⚙️ External commands (1)
Jul 6, 2026, 06:30 PM
The static external command finding is a false positive. SKILL.md uses markdown backticks around a reference file path and does not instruct command execution. No prompt injection, data exfiltration intent, or malicious workflow behavior was found.
Risk Factors
⚙️ External commands (1)
Jun 30, 2026, 07:35 AM
Static findings were reviewed and dismissed as false positives. The weak cryptographic algorithm alerts point to descriptive text, and the backtick alert points to a markdown inline file path. No prompt injection, exfiltration behavior, command execution, or malicious intent was found.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Apr 9, 2026, 08:41 AM
All 3 static analysis findings are false positives. The skill consists only of YAML configuration and markdown documentation files with no executable code. The 'weak cryptographic algorithm' patterns are text matches on non-cryptographic content. The 'external_commands' pattern is a documentation reference to a markdown file, not shell execution. No security risks detected.