📦
Audit History
project-development - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | Aug 9, 2026, 09:56 AM | 3 confirmed | 6 | No capability change |
| v7 | Jul 5, 2026, 08:31 PM | 1 confirmed | 6 | No capability change |
| v6 | Jul 5, 2026, 08:31 PM | 1 confirmed | 6 | External commands Contains scripts |
| v5 | Jun 30, 2026, 07:42 AM | No confirmed findings | 2 | Contains scripts External commands |
| v4 | Jan 17, 2026, 07:01 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 07:01 AM | No confirmed findings | 0 | External commandsNetwork accessFilesystem access |
| v2 | Jan 6, 2026, 07:50 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 6, 2026, 07:50 AM | No confirmed findings | 0 | Baseline |
Audit version 8 Latest
Aug 9, 2026, 09:56 AM
Most static findings are false positives caused by Markdown formatting, documentation examples, benign citations, and mislabeled text. The executable template has medium-risk path traversal, HTML injection, and indirect prompt injection weaknesses. These issues should be fixed before marketplace publication.
4
Files scanned
2,102
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
scripts/pipeline_template.py:132-153scripts/pipeline_template.py:603-652scripts/pipeline_template.py:767-773
Unvalidated Identifiers Permit Path Traversal
Batch and item identifiers are joined without validation. Absolute or traversal paths can redirect writes and cleanup deletions outside intended directories.
The CLI value reaches Path joins without confinement checks, and cleanup unlinks files beneath the resulting path.
Medium
Generated HTML Includes Unescaped Batch Identifier
The batch identifier is inserted into title and heading markup without escaping. A crafted identifier can inject active content when the report opens.
The CLI-controlled batch_id is interpolated directly into two HTML contexts while other displayed strings are explicitly escaped.
Medium
Untrusted Source Content Can Manipulate Model Instructions
Acquired title and content are inserted directly into the model prompt. Malicious source text can alter requested behavior or corrupt structured output.
The template interpolates source fields without trust-boundary controls, then passes the complete prompt to the configured LLM call.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Python file write/append
with open(raw_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Medium
Python file write/append
with open(prompt_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Medium
Python file write/append
with open(response_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Medium
Python file write/append
with open(parsed_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Medium
Python file write/append
with open(agg_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Medium
Python file write/append
with open(output_file, "w") as f:
This executable write uses a path derived from an unvalidated batch identifier. Absolute or traversal values can redirect pipeline output outside the intended directory.
Risk Factors
📁 Filesystem access (12)
references/pipeline-patterns.md:309 references/pipeline-patterns.md:485 references/pipeline-patterns.md:500 references/pipeline-patterns.md:505 references/pipeline-patterns.md:529 references/pipeline-patterns.md:608 scripts/pipeline_template.py:182 scripts/pipeline_template.py:246 scripts/pipeline_template.py:314 scripts/pipeline_template.py:404 scripts/pipeline_template.py:417 scripts/pipeline_template.py:547
⚙️ External commands (18)
🌐 Network access (2)
Audited by: codex
Jul 5, 2026, 08:31 PM
Most static findings are false positives caused by Markdown code fences, reference links, CSS text, or benign words. The executable pipeline template does perform local file writes, and AI review found unvalidated path construction that could let writes or clean operations escape intended directories. No evidence of prompt injection, credential exfiltration, network calls, or malicious command execution was found.
4
Files scanned
2,021
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (1)
High
scripts/pipeline_template.py:96-106scripts/pipeline_template.py:132-137scripts/pipeline_template.py:536-550scripts/pipeline_template.py:641-649
Unvalidated Path Components in Pipeline Template
The executable template accepts batch identifiers from the CLI and combines them directly with data and output directories. Parent directory segments in batch or item identifiers could redirect writes or clean-stage deletions outside the intended project folders.
The path helpers concatenate CLI-controlled batch_id and item identifiers into filesystem paths, and the clean stage unlinks files below that computed path. The script is user-run and intended for local use, so this is high confidence but not critical.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Python file write/append
with open(raw_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(prompt_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(response_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(parsed_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(agg_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(output_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Risk Factors
📁 Filesystem access (12)
references/pipeline-patterns.md:309 references/pipeline-patterns.md:485 references/pipeline-patterns.md:500 references/pipeline-patterns.md:505 references/pipeline-patterns.md:529 references/pipeline-patterns.md:608 scripts/pipeline_template.py:137 scripts/pipeline_template.py:195 scripts/pipeline_template.py:250 scripts/pipeline_template.py:335 scripts/pipeline_template.py:348 scripts/pipeline_template.py:456
⚙️ External commands (9)
🌐 Network access (2)
Audited by: codex
Jul 5, 2026, 08:31 PM
Most static findings are false positives caused by Markdown code fences, reference links, CSS text, or benign words. The executable pipeline template does perform local file writes, and AI review found unvalidated path construction that could let writes or clean operations escape intended directories. No evidence of prompt injection, credential exfiltration, network calls, or malicious command execution was found.
4
Files scanned
2,021
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (1)
High
scripts/pipeline_template.py:96-106scripts/pipeline_template.py:132-137scripts/pipeline_template.py:536-550scripts/pipeline_template.py:641-649
Unvalidated Path Components in Pipeline Template
The executable template accepts batch identifiers from the CLI and combines them directly with data and output directories. Parent directory segments in batch or item identifiers could redirect writes or clean-stage deletions outside the intended project folders.
The path helpers concatenate CLI-controlled batch_id and item identifiers into filesystem paths, and the clean stage unlinks files below that computed path. The script is user-run and intended for local use, so this is high confidence but not critical.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Python file write/append
with open(raw_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(prompt_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(response_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(parsed_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(agg_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Medium
Python file write/append
with open(output_file, "w") as f:
This executable template writes pipeline artifacts to local paths derived from batch and item identifiers. The writes are intended, but unvalidated path components can create or overwrite files outside expected directories.
Risk Factors
📁 Filesystem access (12)
references/pipeline-patterns.md:309 references/pipeline-patterns.md:485 references/pipeline-patterns.md:500 references/pipeline-patterns.md:505 references/pipeline-patterns.md:529 references/pipeline-patterns.md:608 scripts/pipeline_template.py:137 scripts/pipeline_template.py:195 scripts/pipeline_template.py:250 scripts/pipeline_template.py:335 scripts/pipeline_template.py:348 scripts/pipeline_template.py:456
⚙️ External commands (9)
🌐 Network access (2)
Audited by: codex
Jun 30, 2026, 07:42 AM
AI review did not find malicious intent or prompt injection attempts in the skill content. Most high and critical static alerts are false positives caused by Markdown code fences, file names, model names, and documentation examples. The skill includes a runnable Python pipeline template that writes and deletes local files and can be customized to call LLM APIs, so publication should include a clear operational warning.
4
Files scanned
2,021
Lines analyzed
5
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
scripts/pipeline_template.py:125-138scripts/pipeline_template.py:335-349scripts/pipeline_template.py:433-457scripts/pipeline_template.py:508-550
Runnable Template Performs Local File Writes and Deletes
The included Python template creates batch directories, writes raw prompts, parsed results, and rendered HTML, and its clean stage deletes generated stage outputs. This is legitimate pipeline behavior, but users should review paths and run it only inside an intended project directory.
The code directly writes files and deletes selected stage outputs through pathlib. The behavior is explicit and scoped to configured data and output directories, so it is an operational risk rather than evidence of malware.
Medium
scripts/pipeline_template.py:37-63scripts/pipeline_template.py:190-208scripts/pipeline_template.py:270-285
Untrusted Content Is Inserted Into LLM Prompts
The template formats item title and content directly into the LLM prompt. If users adapt the template for untrusted web or document inputs, those inputs can influence downstream model output unless they add prompt-injection handling and validation.
The content insertion path is clear, and the template is intended for LLM processing. There is no malicious payload in the skill files, but projects using untrusted inputs need defensive prompt design.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Command-Execution Alerts Are Markdown False Positives
The Ruby or shell backtick findings correspond to fenced Markdown examples, inline code, or code blocks that describe pipeline structure. I did not find evidence that the skill secretly executes shell commands.
The cited locations are documentation code fences or inline examples, not executable Ruby backticks. The actual Python script does not call subprocess, os.system, eval, or exec.
Low
Hardcoded URLs Are Reference Links
The hardcoded URL findings point to cited external resources for case studies and references. They are not fetched automatically by the skill or script.
The URLs appear in Markdown source and reference sections. No code path was found that automatically sends data to these URLs.
Low
Weak-Cryptography Alerts Are Non-Cryptographic Text Matches
The weak cryptography alerts map to Markdown syntax, file extensions, model names, or generic text rather than cryptographic functions. No evidence found of MD5, SHA1, DES, or similar weak algorithms being used for security.
Reviewed contexts show documentation headings, token estimation, and argparse configuration. They do not implement cryptographic operations.
Risk Factors
⚡ Contains scripts (2)
📁 Filesystem access (7)
🌐 Network access (3)
Detected Patterns
Local Filesystem MutationOptional External LLM API Integration
Audited by: codex
Jan 17, 2026, 07:01 AM
This is a documentation and template skill for LLM project development methodology. All static findings are false positives: markdown files contain code examples for educational purposes, the Python script is a template requiring user customization for legitimate batch processing, and no actual credentials or malicious patterns exist. A previous AI audit also concluded 'safe' with no findings.
5
Files scanned
2,228
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (70)
references/case-studies.md:53-55 references/case-studies.md:55-61 references/case-studies.md:61 references/case-studies.md:61 references/case-studies.md:61-67 references/case-studies.md:67-72 references/case-studies.md:72-78 references/case-studies.md:78 references/case-studies.md:78-84 references/case-studies.md:84 references/case-studies.md:84-90 references/case-studies.md:90-104 references/case-studies.md:104-116 references/case-studies.md:116-124 references/case-studies.md:124-183 references/case-studies.md:183-191 references/pipeline-patterns.md:7-9 references/pipeline-patterns.md:9-27 references/pipeline-patterns.md:27-42 references/pipeline-patterns.md:42-46 references/pipeline-patterns.md:46-60 references/pipeline-patterns.md:60-64 references/pipeline-patterns.md:64-81 references/pipeline-patterns.md:81-87 references/pipeline-patterns.md:87-106 references/pipeline-patterns.md:106-116 references/pipeline-patterns.md:116-136 references/pipeline-patterns.md:136-142 references/pipeline-patterns.md:142-172 references/pipeline-patterns.md:172-178 references/pipeline-patterns.md:178-187 references/pipeline-patterns.md:187-191 references/pipeline-patterns.md:191-198 references/pipeline-patterns.md:198-202 references/pipeline-patterns.md:202-212 references/pipeline-patterns.md:212-216 references/pipeline-patterns.md:216-230 references/pipeline-patterns.md:230-234 references/pipeline-patterns.md:234-263 references/pipeline-patterns.md:263-269 references/pipeline-patterns.md:269-290 references/pipeline-patterns.md:290-294 references/pipeline-patterns.md:294-311 references/pipeline-patterns.md:311-315 references/pipeline-patterns.md:315-333 references/pipeline-patterns.md:333-339 references/pipeline-patterns.md:339-361 references/pipeline-patterns.md:361-365 references/pipeline-patterns.md:365-399 references/pipeline-patterns.md:399-405 references/pipeline-patterns.md:405-463 references/pipeline-patterns.md:463-469 references/pipeline-patterns.md:469-487 references/pipeline-patterns.md:487-491 references/pipeline-patterns.md:491-507 references/pipeline-patterns.md:507-513 references/pipeline-patterns.md:513-544 references/pipeline-patterns.md:544-550 references/pipeline-patterns.md:550-581 references/pipeline-patterns.md:581-585 references/pipeline-patterns.md:585-609 SKILL.md:72-74 SKILL.md:74-88 SKILL.md:88-94 SKILL.md:94-116 SKILL.md:116-130 SKILL.md:130-158 SKILL.md:158-160 SKILL.md:160-190 SKILL.md:190-210
🌐 Network access (4)
📁 Filesystem access (12)
references/pipeline-patterns.md:309 references/pipeline-patterns.md:485 references/pipeline-patterns.md:500 references/pipeline-patterns.md:505 references/pipeline-patterns.md:529 references/pipeline-patterns.md:608 scripts/pipeline_template.py:137 scripts/pipeline_template.py:195 scripts/pipeline_template.py:250 scripts/pipeline_template.py:335 scripts/pipeline_template.py:348 scripts/pipeline_template.py:456
Audited by: claude
Jan 17, 2026, 07:01 AM
This is a documentation and template skill for LLM project development methodology. All static findings are false positives: markdown files contain code examples for educational purposes, the Python script is a template requiring user customization for legitimate batch processing, and no actual credentials or malicious patterns exist. A previous AI audit also concluded 'safe' with no findings.
5
Files scanned
2,228
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (70)
references/case-studies.md:53-55 references/case-studies.md:55-61 references/case-studies.md:61 references/case-studies.md:61 references/case-studies.md:61-67 references/case-studies.md:67-72 references/case-studies.md:72-78 references/case-studies.md:78 references/case-studies.md:78-84 references/case-studies.md:84 references/case-studies.md:84-90 references/case-studies.md:90-104 references/case-studies.md:104-116 references/case-studies.md:116-124 references/case-studies.md:124-183 references/case-studies.md:183-191 references/pipeline-patterns.md:7-9 references/pipeline-patterns.md:9-27 references/pipeline-patterns.md:27-42 references/pipeline-patterns.md:42-46 references/pipeline-patterns.md:46-60 references/pipeline-patterns.md:60-64 references/pipeline-patterns.md:64-81 references/pipeline-patterns.md:81-87 references/pipeline-patterns.md:87-106 references/pipeline-patterns.md:106-116 references/pipeline-patterns.md:116-136 references/pipeline-patterns.md:136-142 references/pipeline-patterns.md:142-172 references/pipeline-patterns.md:172-178 references/pipeline-patterns.md:178-187 references/pipeline-patterns.md:187-191 references/pipeline-patterns.md:191-198 references/pipeline-patterns.md:198-202 references/pipeline-patterns.md:202-212 references/pipeline-patterns.md:212-216 references/pipeline-patterns.md:216-230 references/pipeline-patterns.md:230-234 references/pipeline-patterns.md:234-263 references/pipeline-patterns.md:263-269 references/pipeline-patterns.md:269-290 references/pipeline-patterns.md:290-294 references/pipeline-patterns.md:294-311 references/pipeline-patterns.md:311-315 references/pipeline-patterns.md:315-333 references/pipeline-patterns.md:333-339 references/pipeline-patterns.md:339-361 references/pipeline-patterns.md:361-365 references/pipeline-patterns.md:365-399 references/pipeline-patterns.md:399-405 references/pipeline-patterns.md:405-463 references/pipeline-patterns.md:463-469 references/pipeline-patterns.md:469-487 references/pipeline-patterns.md:487-491 references/pipeline-patterns.md:491-507 references/pipeline-patterns.md:507-513 references/pipeline-patterns.md:513-544 references/pipeline-patterns.md:544-550 references/pipeline-patterns.md:550-581 references/pipeline-patterns.md:581-585 references/pipeline-patterns.md:585-609 SKILL.md:72-74 SKILL.md:74-88 SKILL.md:88-94 SKILL.md:94-116 SKILL.md:116-130 SKILL.md:130-158 SKILL.md:158-160 SKILL.md:160-190 SKILL.md:190-210
🌐 Network access (4)
📁 Filesystem access (12)
references/pipeline-patterns.md:309 references/pipeline-patterns.md:485 references/pipeline-patterns.md:500 references/pipeline-patterns.md:505 references/pipeline-patterns.md:529 references/pipeline-patterns.md:608 scripts/pipeline_template.py:137 scripts/pipeline_template.py:195 scripts/pipeline_template.py:250 scripts/pipeline_template.py:335 scripts/pipeline_template.py:348 scripts/pipeline_template.py:456
Audited by: claude
Jan 6, 2026, 07:50 AM
This is a documentation-only skill with no executable code. The Python script provided is a template that users customize for their own LLM batch processing pipelines. No security concerns detected.
4
Files scanned
943
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 6, 2026, 07:50 AM
This is a documentation-only skill with no executable code. The Python script provided is a template that users customize for their own LLM batch processing pipelines. No security concerns detected.
4
Files scanned
943
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude