📦

Audit History

godot-4-migration - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Change vs previous
v5 Latest	Jul 24, 2026, 12:30 AM	No confirmed findings	No capability change
v4	Jul 8, 2026, 11:40 AM	No confirmed findings	No capability change
v3	Jul 7, 2026, 01:11 AM	No confirmed findings	External commands
v2	Jun 30, 2026, 04:23 PM	No confirmed findings	No capability change
v1	Feb 25, 2026, 02:51 AM	No confirmed findings	Baseline

Audit version 5 Latest

Jul 24, 2026, 12:30 AM

All 33 external-command detections are Markdown backticks used for Godot names or fenced GDScript examples; none invokes a shell. The reconnaissance detection is an ordinary Godot error message, and no prompt injection or malicious intent appears in SKILL.md.

Files scanned

133

Lines analyzed

Review items

False positives ignored

Audited by: codex

Audit version 4

Jul 8, 2026, 11:40 AM

The static external command alerts are false positives caused by Markdown inline code and GDScript examples in SKILL.md. The system reconnaissance alert is also a false positive because it is a Godot troubleshooting heading. No prompt injection, data exfiltration, network access, or command execution intent was found.

Files scanned

133

Lines analyzed

Review items

False positives ignored

Audited by: codex

Audit version 3

Jul 7, 2026, 01:11 AM

All static findings are false positives caused by Markdown backticks, GDScript code fences, and a quoted Godot error message. No prompt injection, data exfiltration, command execution instructions, or system reconnaissance behavior was found in SKILL.md.

Files scanned

127

Lines analyzed

Review items

False positives ignored

Audited by: codex

Audit version 2

Jun 30, 2026, 04:23 PM

Static analysis flagged Markdown backticks, weak cryptography, and reconnaissance patterns, but review found only prose and GDScript examples. No shell execution, cryptographic operation, system probing, network access, data exfiltration, or prompt injection text was found in SKILL.md.

Files scanned

127

Lines analyzed

Review items

False positives ignored

Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:12 SKILL.md:18-19 SKILL.md:23-28 SKILL.md:35-67 SKILL.md:73-81 SKILL.md:89-114 SKILL.md:118-126

False Positive: Markdown Backticks Flagged as Commands

The detected backticks are Markdown inline code and fenced GDScript examples for Godot migration. They do not define or invoke shell, Ruby, or system commands.

The file is Markdown documentation with GDScript snippets only. No executable script file, command interpreter call, or user-controlled command construction appears in the reviewed content.

Low

SKILL.md:3 SKILL.md:18

False Positive: Weak Cryptography Pattern

The weak cryptography alerts on lines 3 and 18 do not correspond to any cryptographic API, hashing function, cipher, or credential handling. They are migration description text and Godot terminology.

The cited lines contain descriptive skill metadata and a Godot Tween migration note. There is no evidence of MD5, SHA1, DES, encryption, signing, or password storage logic.

Low

SKILL.md:125-126

False Positive: System Reconnaissance Pattern

The system reconnaissance alert points to a troubleshooting sentence about the Godot Tween type. It does not inspect the host, list files, read environment data, or collect system metadata.

The cited lines are documentation for a common Godot compiler error. No operating system command, filesystem enumeration, or environment query is present.

No confirmed security findings were recorded for this completed audit.

Audited by: codex

Audit version 1

Feb 25, 2026, 02:51 AM

All static findings are false positives. The skill contains only documentation for Godot 4 migration with GDScript code examples. No shell commands, cryptographic code, or system reconnaissance present.

Files scanned

127

Lines analyzed

Review items

False positives ignored

Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Medium

SKILL.md:12-126

False Positive: Shell Command Detection

Scanner flagged GDScript method calls like create_tween() and $Tween as shell commands. These are Godot game engine API calls, not system commands.

All flagged lines contain GDScript code examples (e.g., $Tween.interpolate_property, create_tween()) which are Godot API methods, not shell execution

Medium

SKILL.md:3-18

False Positive: Weak Cryptographic Algorithm

Scanner triggered on word 'deprecated' which contains character patterns matching crypto detection. No cryptographic code exists in this skill.

The word 'deprecated' triggered false pattern match. No cryptographic algorithms present.

Medium

SKILL.md:125

False Positive: System Reconnaissance

Scanner triggered on the word 'Problem:' in troubleshooting section. This is a documentation heading, not reconnaissance.

Line contains 'Problem:' as a documentation heading in troubleshooting section.

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill

Audit History

Version comparison

Risk Factors

Risk Factors

Risk Factors