Audit History
bazel-build-optimization - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Aug 14, 2026, 10:18 AM | 1 confirmed | 0 | No capability change |
| v4 | Jul 5, 2026, 11:24 PM | No confirmed findings | 0 | No capability change |
| v3 | Jul 5, 2026, 11:24 PM | No confirmed findings | 0 | No capability change |
| v2 | Jun 30, 2026, 12:58 PM | No confirmed findings | 3 | External commandsNetwork accessFilesystem access |
| v1 | Feb 25, 2026, 04:05 AM | No confirmed findings | 0 | Baseline |
Aug 14, 2026, 10:18 AM
All 32 static findings are false positives caused by Markdown formatting, examples, trusted documentation links, cache paths, and a Bazel mnemonic. One medium semantic risk remains: the remote execution template uses a mutable latest container tag, which can change without review.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (21)
🌐 Network access (6)
📁 Filesystem access (4)
Jul 5, 2026, 11:24 PM
The flagged items are Markdown examples, code fences, cache path examples, public documentation links, or Bazel configuration snippets. I found no prompt injection, hidden execution path, credential collection, or data exfiltration intent in SKILL.md.
Risk Factors
⚙️ External commands (21)
🌐 Network access (6)
📁 Filesystem access (4)
Jul 5, 2026, 11:24 PM
The flagged items are Markdown examples, code fences, cache path examples, public documentation links, or Bazel configuration snippets. I found no prompt injection, hidden execution path, credential collection, or data exfiltration intent in SKILL.md.
Risk Factors
⚙️ External commands (21)
🌐 Network access (6)
📁 Filesystem access (4)
Jun 30, 2026, 12:58 PM
Static analysis flagged command execution, network URLs, filesystem paths, weak crypto terms, and heuristic combinations. Context shows a Bazel markdown guide with legitimate examples, but the shell commands and remote cache settings can affect builds or upload artifacts if applied without review. No evidence found of prompt injection, credential theft, obfuscation, or malicious intent.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (2)
🌐 Network access (3)
📁 Filesystem access (1)
Detected Patterns
Feb 25, 2026, 04:05 AM
Static analysis detected 36 potential issues (external_commands, network, filesystem patterns), but all are false positives. The skill contains documentation and templates for Bazel build optimization with example commands and configuration snippets - no actual executable code with security implications. URLs are legitimate documentation links, filesystem references are standard Bazel cache paths, and cryptographic mentions are SHA256 checksums for download verification.