Versioned security assessment

Report ID: SA-29C87FD6

2/24/2026, 5:16:48 PM

ai-ml security assessment v1

Skill Security Certification Report

Audit History
Audit model: claude Historical report
Skill name
ai-ml
Version
v1
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/ai-ml
Coverage
1 Files scanned · 254 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged 75 potential issues (external_commands, weak_crypto, system_reconnaissance) but all are false positives. The file is a markdown documentation bundle that orchestrates other skills via reference names in code blocks. No actual code execution, shell commands, or cryptographic operations exist. This is safe for publication.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 254 Lines analyzed

0 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Not recorded by this audit

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Medium
SKILL.md:32-252
False Positive: External Commands Detection
Static analyzer detected 'Ruby/shell backtick execution' at 64 locations (lines 32-252). These are markdown code fences (```) containing example prompts like 'Use @ai-product to design AI-powered features', NOT actual shell commands. The backtick syntax is markdown formatting for code blocks.
Markdown code blocks with example prompts do not execute. The '@' references are skill invocation patterns, not shell commands. No backticks used for command substitution exist in this file.
Medium
SKILL.md:3-155
False Positive: Weak Cryptographic Algorithm
Static analyzer flagged 'weak cryptographic algorithm' at 11 locations (lines 3, 29, 40, 46, 50, 93, 103, 125, 142, 155). These are YAML frontmatter fields like 'risk: safe', 'domain: artificial-intelligence' - configuration metadata, not crypto algorithms.
YAML frontmatter contains only metadata fields (name, description, risk, domain, category, version). No cryptographic code or algorithms present.
Medium
SKILL.md:90
False Positive: System Reconnaissance
Static analyzer flagged 'system reconnaissance' at line 90. Line 90 contains '- hybrid-search-implementation', a skill reference name in a list of related skills. This is not reconnaissance activity.
The text 'hybrid-search-implementation' is a skill name, not a network scanning or reconnaissance command.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable