📦

Audit History

data-quality-frameworks - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v5 LatestJul 23, 2026, 10:15 PM 1 confirmed0No capability change
v4 Jul 8, 2026, 10:22 AM No confirmed findings0No capability change
v3 Jul 6, 2026, 10:58 PM No confirmed findings0 Network access
v2 Jun 30, 2026, 02:59 PM 1 confirmed0External commandsNetwork access
v1 Feb 24, 2026, 06:43 PM No confirmed findings0Baseline

Jul 23, 2026, 10:15 PM

All 16 static alerts are false positives caused by Markdown references, schema fields, SQL identifiers, and ordinary safety guidance. One medium-risk semantic issue remains because an example report includes raw observed values and can print them to pipeline logs.

2
Files scanned
623
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Validation Reports May Expose Sensitive Values
The example stores observed validation values and adds failed values to a report that can be printed in pipeline logs.
The example directly copies observed values into report details and prints the report on failure. These values can contain sensitive dataset content.

Risk Factors

⚙️ External commands (2)
Audited by: codex

Jul 8, 2026, 10:22 AM

All static findings are false positives caused by data-quality terminology, Markdown resource links, or example schema fields. The reviewed files describe Great Expectations, dbt tests, and data contracts, with no evidence of system reconnaissance, network reconnaissance, command execution, prompt injection, or exfiltration intent.

2
Files scanned
623
Lines analyzed
1
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (2)
Audited by: codex

Jul 6, 2026, 10:58 PM

The static findings are false positives caused by headings, sample column names, inline markdown paths, and data quality examples. No prompt injection, malicious intent, or executable shell behavior was found in the reviewed files.

2
Files scanned
615
Lines analyzed
1
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (2)
Audited by: codex

Jun 30, 2026, 02:59 PM

The high static score is driven by markdown examples, inline framework names, and documentation links rather than executable skill code. No malicious intent, prompt injection, credential exfiltration, or hidden automation was found. Minor risk remains because the playbook includes user-run setup commands and notification examples that may expose validation details if configured poorly.

2
Files scanned
615
Lines analyzed
3
Review items
3
False positives ignored

Confirmed security concerns (1)

Low
Notification Example Could Expose Validation Details
The Great Expectations checkpoint example includes a Slack webhook placeholder for failure notifications. This is a legitimate pattern, but users should avoid sending sensitive row values or PII in validation alerts.
The notification pattern is explicit, but it uses an environment placeholder and does not hardcode a destination. Exposure depends on user configuration and validation result contents.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
External Command Examples Are Documentation Only
Static analysis flagged shell-like content, but the reviewed lines are markdown examples for installing and initializing Great Expectations or opening the implementation playbook. These examples are not executed by the skill and do not contain dynamic command construction.
The flagged content appears inside markdown instructions and fenced examples. I found no executable script, hook, or user-input command injection path.
Low
Framework Syntax Misclassified as Security Indicators
The weak cryptography and reconnaissance flags map to ordinary data modeling terms such as primary key, foreign key, UUID format, timestamps, and dbt ref syntax. These are normal data quality concepts and not evidence of malware or system probing.
The reviewed context is schema and test documentation, not cryptographic or reconnaissance code. The terms are semantically tied to data contracts and dbt examples.
Low
Documentation Links Are Benign Network References
The hardcoded URLs are links to official documentation for Great Expectations, dbt, data contracts, and Soda Core. They are not fetched by code and do not transmit local data.
The URLs appear only in a markdown Resources section. I found no code path that requests these URLs or sends data to them.
Audited by: codex

Feb 24, 2026, 06:43 PM

This is a documentation-only skill providing markdown guides for data quality frameworks. All static analysis findings are false positives: code blocks are markdown examples not executable code, URLs are documentation references, and pattern matches on SQL terms are not actual system calls.

2
Files scanned
617
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude