Audit History
run-nx-generator - 7 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v7 Latest | Jul 5, 2026, 08:01 PM | No confirmed findings | 0 | No capability change |
| v6 | Jul 5, 2026, 08:01 PM | No confirmed findings | 0 | No capability change |
| v5 | Jun 30, 2026, 10:42 AM | No confirmed findings | 1 | No capability change |
| v4 | Jan 17, 2026, 07:29 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 07:29 AM | No confirmed findings | 0 | External commands |
| v2 | Jan 6, 2026, 01:21 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 6, 2026, 01:21 AM | No confirmed findings | 0 | Baseline |
Jul 5, 2026, 08:01 PM
The static findings are Markdown backtick and code block detections around documented Nx commands, not Ruby shell execution. The skill does intentionally guide shell-based Nx workflows, so users should review generated commands and workspace changes before execution. No prompt injection, data exfiltration, or hidden malicious intent was found in SKILL.md.
Risk Factors
Jul 5, 2026, 08:01 PM
The static findings are Markdown backtick and code block detections around documented Nx commands, not Ruby shell execution. The skill does intentionally guide shell-based Nx workflows, so users should review generated commands and workspace changes before execution. No prompt injection, data exfiltration, or hidden malicious intent was found in SKILL.md.
Risk Factors
Jun 30, 2026, 10:42 AM
Static analysis flagged many Markdown backticks and generator wording. The weak cryptography findings are false positives, but the skill intentionally guides shell commands that can modify a workspace.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
Detected Patterns
Jan 17, 2026, 07:29 AM
This is a documentation-only skill providing guidance on running Nx generators. All 29 static findings are false positives: MD5 hashes are content identifiers in metadata, backticks are markdown code formatting, URLs are source references, and the skill contains no executable code, network requests, or external command execution.
Risk Factors
Jan 17, 2026, 07:29 AM
This is a documentation-only skill providing guidance on running Nx generators. All 29 static findings are false positives: MD5 hashes are content identifiers in metadata, backticks are markdown code formatting, URLs are source references, and the skill contains no executable code, network requests, or external command execution.
Risk Factors
Jan 6, 2026, 01:21 AM
This is a documentation-only skill that provides guidance on running Nx generators. The skill file contains no executable code, makes no network requests, does not access the filesystem beyond its own content, and does not execute external commands. The referenced MCP tools are legitimate Nx tooling for generator discovery and execution.
Jan 6, 2026, 01:21 AM
This is a documentation-only skill that provides guidance on running Nx generators. The skill file contains no executable code, makes no network requests, does not access the filesystem beyond its own content, and does not execute external commands. The referenced MCP tools are legitimate Nx tooling for generator discovery and execution.