Versioned security assessment

Report ID: SA-5A26D1D6

8/14/2026, 10:03:57 AM

bash-linux security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
bash-linux
Version
v5
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/bash-linux
Coverage
1 Files scanned · 210 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives caused by Markdown formatting, illustrative shell syntax, reserved example URLs, and comparison headings. Confirmed concerns involve predictable shared temporary-file cleanup and guidance that may expose secrets or terminate unintended processes.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 210 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (1)
Medium
SKILL.md:194
Temp directory access
rm -f /tmp/tempfile
The cleanup example deletes a fixed path in the shared /tmp directory. That predictable name can collide with another process or user's file.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:81
Environment Variable Disclosure Guidance
The skill recommends env or printenv without warning that full output can expose credentials and tokens in terminals, logs, or AI context.
The command explicitly prints the complete process environment, which commonly contains secrets. The surrounding text provides no redaction or scope warning.
RISK-002 Medium
SKILL.md:52-54
Unvalidated Forced Process Termination
The process examples recommend SIGKILL and derive targets from a port without confirmation, graceful shutdown, or PID validation.
The documented commands explicitly use kill -9, including every PID returned for port 3000. No ownership or identity check is shown.
RISK-003 Medium
SKILL.md:186
Shell Trace May Reveal Secrets
The error-handling section recommends set -x without warning that expanded commands can expose passwords, tokens, and sensitive arguments.
Bash tracing prints expanded command arguments, and the line presents tracing as a general debugging option without secret-handling safeguards.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The cleanup example deletes a predictable shared temporary path.
    Create temporary files with mktemp, store the generated path, quote it, and remove only that validated path during cleanup.
  2. FIX-002
    Medium
    The environment example prints every variable and may reveal secrets.
    Recommend printing only named non-sensitive variables and warn users to redact credentials before sharing output.
  3. FIX-003
    Medium
    The process examples use kill -9 without graceful shutdown or target validation.
    Use a normal termination signal first, verify each PID and owner, request confirmation, and reserve SIGKILL for failed shutdowns.
  4. FIX-004
    Medium
    The set -x example can print secret values and sensitive arguments.
    Add a warning, disable tracing around sensitive commands, and avoid tracing scripts that handle credentials.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
5a26d1d61d694db29af9b138c661c1981076d9df
Content hash
8c2479ab77d4c3fe751cbe4a3de56b388bafc382b4cf1193372566c6778aa4b5
Tree hash
cf51d3a5facf9825cb0b2e7f4bc9d61bdd05566b71deb9293fd7bea17d91e992
Skill path
skills/sickn33/bash-linux
Audit payload hash
260792353daaec069126de8721cd4ec9

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active