📦

Audit History

github-issue-creator - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v5 LatestJul 23, 2026, 11:58 PM 1 confirmed0No capability change
v4 Jul 8, 2026, 10:57 AM No confirmed findings0No capability change
v3 Jul 7, 2026, 01:01 AM No confirmed findings0External commands Filesystem access
v2 Jun 30, 2026, 03:56 PM No confirmed findings1Filesystem access
v1 Feb 25, 2026, 02:50 AM No confirmed findings0Baseline

Jul 23, 2026, 11:58 PM

All 13 static findings are false positives caused by Markdown code fences and inline code spans. No Ruby or shell command execution appears in SKILL.md. The skill requests repository file creation, creating a limited filesystem write risk.

1
Files scanned
149
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (1)

Low
Repository File Creation Without Collision Safeguard
SKILL.md instructs the agent to create Markdown files in /issues/ with deterministic date-based names, but it does not require an existence check before writing.
Line 52 explicitly requires file creation and defines the naming format. No collision or overwrite safeguard is stated.
Audited by: codex

Jul 8, 2026, 10:57 AM

The static findings are false positives caused by Markdown fences and inline code spans in SKILL.md. I found no Ruby execution, shell execution, prompt injection, network access, or malicious intent in the skill instructions.

1
Files scanned
149
Lines analyzed
1
Review items
0
False positives ignored
Audited by: codex

Jul 7, 2026, 01:01 AM

The external command detections are false positives caused by Markdown code fences and inline code examples in SKILL.md. I found no Ruby execution, shell command execution, prompt injection, network access, credential access, or malicious intent in the skill instructions.

1
Files scanned
137
Lines analyzed
1
Review items
0
False positives ignored
Audited by: codex

Jun 30, 2026, 03:56 PM

Static findings for Ruby shell backticks and weak cryptography are false positives caused by Markdown fences, Markdown examples, and .md naming text in SKILL.md. No malicious command execution, cryptographic code, exfiltration, or prompt injection evidence was found. The skill has low risk because it instructs the assistant to create issue Markdown files in an /issues/ directory.

1
Files scanned
137
Lines analyzed
2
Review items
2
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Repository File Creation Instruction
The skill instructs the assistant to create issue reports as Markdown files in an /issues/ directory at the repository root. This is expected functionality, but it does require filesystem writes and should stay scoped to issue drafts.
The file creation instruction is explicit and matches the skill purpose. The risk is low because the target path and file type are narrow and no destructive operation is requested.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
False Positive: Markdown Fences Flagged as Shell Execution
The external command findings point to Markdown code fences and example Markdown output, not Ruby backtick execution. No shell command, interpreter invocation, or user-controlled command construction is present in the reviewed file.
The suspicious characters are triple backtick Markdown delimiters around templates and examples. The file contains no Ruby code or executable command call at these locations.
Low
False Positive: Markdown Text Flagged as Weak Cryptography
The weak cryptography findings are not cryptographic operations. They are ordinary issue-template text, Markdown references, and the .md filename convention used for issue files.
The reviewed lines do not implement hashing, encryption, or authentication. The strongest evidence is the .md file extension on line 49, which is unrelated to MD5 or weak crypto.

Risk Factors

📁 Filesystem access (1)
Audited by: codex

Feb 25, 2026, 02:50 AM

Static analyzer flagged 21 patterns as potential security issues, but all are false positives. The SKILL.md file contains only markdown documentation and prompt templates - no executable code. Backtick characters are used for markdown code blocks and inline code formatting, not shell command execution. No cryptographic functions or external command execution present.

1
Files scanned
143
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude