Versioned security assessment

Report ID: SA-26421118

7/9/2026, 2:09:15 PM

manifest security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
manifest
Version
v5
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/manifest
Coverage
1 Files scanned · 127 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is a legitimate Manifest setup guide, but it performs security-sensitive actions. Confirmed risks include plugin installation, gateway changes, API key handling, telemetry endpoint configuration, and local hidden log access; many Markdown backtick findings were false positives.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 127 Lines analyzed

14 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 26 evidence locations

Capability review items (13)
High
SKILL.md:59-61
Ruby/shell backtick execution
```bash
The fenced block runs a Claude CLI configuration command with a user-provided API key. This writes sensitive configuration and can expose secrets through command handling.
High
SKILL.md:67-69
Ruby/shell backtick execution
```bash
The fenced block runs a Claude CLI command that sets a custom telemetry endpoint. A user-controlled endpoint can redirect observability data outside the expected service.
High
SKILL.md:82
Hidden file in home directory
grep "manifest" ~/.claude/logs/gateway.log | tail -5
The command reads a hidden Claude gateway log under the user home directory. Even read-only log access can expose sensitive operational or configuration data.
High
SKILL.md:60
Generic API/secret keys
claude config set plugins.entries.manifest.config.apiKey "USER_API_KEY"
The command persists a user-provided Manifest API key in Claude plugin configuration. Secrets can be exposed through shell history, logs, or insecure config storage.
High
SKILL.md:63
Generic API/secret keys
Replace `USER_API_KEY` with the actual key the user provided.
The prose instructs replacing the placeholder with the actual API key. That is explicit secret handling and requires careful redaction and storage controls.
Medium
SKILL.md:32-34
Ruby/shell backtick execution
```bash
The fenced block instructs running a Claude CLI command that stops the local gateway. It has hardcoded arguments, but it still changes local agent runtime state.
Medium
SKILL.md:38-40
Ruby/shell backtick execution
```bash
The fenced block installs a Manifest plugin through the Claude CLI. Installing agent plugins changes executable agent behavior and creates supply-chain risk.
Medium
SKILL.md:73-75
Ruby/shell backtick execution
```bash
The fenced block runs a Claude CLI gateway installation command. It changes local agent runtime components and should require explicit user approval.
Medium
SKILL.md:81-83
Ruby/shell backtick execution
```bash
The fenced block runs a shell pipeline that reads the Claude gateway log from the home directory. Log output can contain sensitive operational data.
Medium
SKILL.md:105-111
Ruby/shell backtick execution
| Duplicate OTel registration | Disable the conflicting built-in plugin: `claude plugins disable dia
The troubleshooting table includes a Claude CLI command that disables another plugin. It alters local plugin state and can reduce existing telemetry coverage.
Medium
SKILL.md:65
Hardcoded URL
Ask the user if they have a custom endpoint. If not, the default (`https://app.manifest.build/api/v1
The default endpoint is a hosted OTLP API destination for telemetry. Sending agent observability data to that endpoint requires user consent and trust verification.
Medium
SKILL.md:82
Hidden file access
grep "manifest" ~/.claude/logs/gateway.log | tail -5
The command accesses a hidden Claude log file for troubleshooting. The use is legitimate, but it is still sensitive local filesystem access.
Low
SKILL.md:50
Hardcoded URL
> 1. Go to **https://app.manifest.build** and create an account (or sign in)
The skill directs users to a hosted Manifest web application to create an account and API key. This is expected for setup, but it is a real external service dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:14-16SKILL.md:65SKILL.md:118
Telemetry Export To External Endpoint
The instructions connect agent observability data to Manifest or a custom OTLP endpoint. This can disclose agent activity outside the local environment and requires explicit consent.
The skill explicitly describes connecting agents to Manifest for monitoring and configuring hosted or custom endpoints. The exact telemetry contents are not shown, so confidence is high but not absolute.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    API key setup requires secret handling.
    Use masked input where available, avoid echoing keys, warn about shell history, and document where the key is stored.
  2. FIX-002
    High
    Troubleshooting reads hidden gateway logs.
    Limit log output, redact sensitive values, and ask for confirmation before displaying log contents.
  3. FIX-003
    Medium
    Plugin and gateway commands change local agent behavior.
    Require explicit user approval before installing plugins, stopping gateways, starting gateways, or disabling other telemetry plugins.
  4. FIX-004
    Medium
    Telemetry endpoints can receive agent activity data.
    Ask users to verify endpoint ownership and explain what telemetry may leave the local environment.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
26421118b848d9f1efc0aa169d8a7a9e7e0a877e
Content hash
7c7cfd184ded2c40b162784281954ffc2e770532bf63dceafe7d26e8d7231706
Tree hash
c5ce74be753f2a2554d345b0fa941f2db4b2212409d8819374aff027b99eb4ca
Skill path
skills/sickn33/manifest
Audit payload hash
70a6149f2fcf505f2bf127561aa9cd17

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable