📦

Audit History

bevy-ecs-expert - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Change vs previous
v5 Latest	Aug 14, 2026, 10:24 AM	No confirmed findings	Contains scripts
v4	Jul 6, 2026, 11:29 PM	No confirmed findings	No capability change
v3	Jul 6, 2026, 11:29 PM	No confirmed findings	External commands
v2	Jun 30, 2026, 01:04 PM	No confirmed findings	No capability change
v1	Feb 25, 2026, 04:38 AM	No confirmed findings	Baseline

Audit version 5 Latest

Aug 14, 2026, 10:24 AM

All 22 static findings are false positives caused by Rust syntax, Bevy ECS APIs, or Markdown backticks. The guide contains no executable scripts, shell commands, process launches, or prompt injection.

Files scanned

142

Lines analyzed

Review items

False positives ignored

Risk Factors

⚡ Contains scripts (1)

SKILL.md:93

⚙️ External commands (21)

Audited by: codex

Audit version 4

Jul 6, 2026, 11:29 PM

The static external command findings are false positives from Markdown formatting and Bevy ECS Rust examples. No prompt injection, shell execution, data exfiltration, network abuse, or malicious intent was found in SKILL.md.

Files scanned

134

Lines analyzed

Review items

False positives ignored

Audited by: codex

Audit version 3

Jul 6, 2026, 11:29 PM

Files scanned

134

Lines analyzed

Review items

False positives ignored

Audited by: codex

Audit version 2

Jun 30, 2026, 01:04 PM

Static analysis reported 27 external command patterns and two weak cryptography patterns in SKILL.md. Manual review found these are false positives from Markdown and Rust examples: Bevy's commands.spawn creates ECS entities, and the flagged prose is not cryptographic code. No prompt injection, data exfiltration, network access, filesystem access, or executable script behavior was found.

Files scanned

134

Lines analyzed

Review items

False positives ignored

Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:97

False Positive: Bevy Entity Spawn API

The high external command finding points to commands.spawn in a Rust Bevy example. This API creates an ECS entity and does not start an operating system process or shell command.

The surrounding Rust example defines setup with Commands and PlayerBundle. The call is clearly Bevy ECS entity spawning, not child process execution.

Low

SKILL.md:25 SKILL.md:27-37 SKILL.md:43-53 SKILL.md:57-68 SKILL.md:72-82 SKILL.md:88-106 SKILL.md:110-120 SKILL.md:124-128

False Positive: Markdown Backticks and Rust Examples

The medium external command findings are Markdown inline code and fenced Rust examples for Component, Query, Resource, With, Without, Bundle, RefCell, and related Bevy concepts. They do not execute shell commands.

The cited text is documentation and Rust code snippets inside Markdown. No shell interpreter, subprocess API, or dynamic command construction appears in these locations.

Low

SKILL.md:3 SKILL.md:17

False Positive: Weak Cryptography Pattern

The weak cryptographic algorithm findings match ordinary skill metadata and usage prose about ECS and designing systems. No cryptographic primitive, hashing code, or encryption API is present.

Both cited lines are prose or metadata, not executable code. The matches appear to be substring collisions rather than actual DES, MD5, or other weak cryptographic use.

No confirmed security findings were recorded for this completed audit.

Audited by: codex

Audit version 1

Feb 25, 2026, 04:38 AM

Static analysis detected patterns from Rust code examples in documentation (commands.spawn() is Bevy ECS entity spawning, not shell commands). This is a pure documentation skill with no executable code. All detections are false positives from markdown code blocks. Safe to publish.

Files scanned

134

Lines analyzed

Review items

False positives ignored

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:25-37 SKILL.md:43-53 SKILL.md:57-68 SKILL.md:74-82 SKILL.md:88-106

False Positive: External Commands Pattern

Static analyzer detected 'external_commands' patterns in Rust code examples. These are Bevy ECS commands.spawn() calls for entity spawning in game code, not shell command execution. The skill contains only documentation with code examples.

Bevy ECS is a Rust game engine; commands.spawn() is the standard API for creating entities in the ECS world, not executing shell commands. The context clearly shows this is documentation for game development.

Low

SKILL.md:3 SKILL.md:17

False Positive: Weak Cryptography Detection

Static analyzer flagged 'weak cryptographic algorithm' at lines 3 and 17, but these are the YAML frontmatter 'description' field and regular documentation text, not cryptographic code.

Line 3 is YAML frontmatter metadata (description field), line 17 is plain English text about when to use the skill. No cryptographic operations present in the file.

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill