📦
Audit History
writing-skills - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 7, 2026, 04:50 AM | 1 confirmed | 0 | No capability change |
| v4 | Jul 7, 2026, 04:50 AM | 1 confirmed | 0 | Network access |
| v3 | Jun 30, 2026, 08:21 PM | 2 confirmed | 3 | No capability change |
| v2 | Jun 30, 2026, 08:21 PM | 2 confirmed | 3 | Contains scriptsExternal commandsFilesystem accessNetwork access |
| v1 | Feb 25, 2026, 10:48 AM | No confirmed findings | 0 | Baseline |
Audit version 5 Latest
Jul 7, 2026, 04:50 AM
Most static findings are false positives from Markdown examples, inline code, and documented configuration paths. The bundled Graphviz helper uses hardcoded commands and visible file writes, with no evidence of command injection, exfiltration, persistence, or prompt-injection text. A semantic concern remains because the skill teaches dual-use persuasion techniques for increasing agent compliance.
21
Files scanned
4,086
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
persuasion-principles.md:5-7persuasion-principles.md:153-165references/anti-rationalization/README.md:113-150
Dual-use Agent Compliance Persuasion Guidance
The skill teaches authors to use persuasion principles, strong authority language, and commitment framing to increase AI agent compliance. It includes ethical cautions, but the guidance could be adapted to override agent judgment outside user-approved quality workflows.
The cited files explicitly describe compliance-increasing persuasion techniques and also provide ethical boundaries. Confidence is high for dual-use content but lower than malicious because the stated purpose is quality enforcement.
Risk Factors
⚙️ External commands (57)
anthropic-best-practices.md:434-454 anthropic-best-practices.md:476-478 anthropic-best-practices.md:478-482 anthropic-best-practices.md:482-486 anthropic-best-practices.md:486-492 anthropic-best-practices.md:492-496 anthropic-best-practices.md:496-499 anthropic-best-practices.md:534-535 anthropic-best-practices.md:535-541 anthropic-best-practices.md:541-543 anthropic-best-practices.md:565-572 anthropic-best-practices.md:572-576 anthropic-best-practices.md:1082-1085 examples.md:70-71 examples.md:71-72 examples.md:96-97 examples.md:97-102 examples.md:113-116 examples.md:258 examples.md:263 gotchas.md:105-106 references/standards/README.md:15-20 references/tier-3-platform/README.md:72-81 render-graphs.js:18 render-graphs.js:25 render-graphs.js:72 render-graphs.js:112 render-graphs.js:10-22 render-graphs.js:22 render-graphs.js:30-55 render-graphs.js:58-61 render-graphs.js:67-106 render-graphs.js:106-124 render-graphs.js:124-128 render-graphs.js:128-140 render-graphs.js:140-142 render-graphs.js:142-145 render-graphs.js:145-147 render-graphs.js:147-156 render-graphs.js:156-158 render-graphs.js:158-160 render-graphs.js:160-165 SKILL.md:61 SKILL.md:68-82 SKILL.md:82-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-99 SKILL.md:99-100 SKILL.md:100-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-110 SKILL.md:110-115 SKILL.md:115-118 SKILL.md:118-121 SKILL.md:121-125
📁 Filesystem access (32)
anthropic-best-practices.md:870 gotchas.md:162 gotchas.md:165 gotchas.md:162 gotchas.md:165 gotchas.md:172 references/standards/README.md:14 references/standards/README.md:14 render-graphs.js:120 render-graphs.js:132 render-graphs.js:141 render-graphs.js:146 render-graphs.js:157 render-graphs.js:105 render-graphs.js:131 render-graphs.js:120 render-graphs.js:141 render-graphs.js:146 render-graphs.js:157 render-graphs.js:96 render-graphs.js:97 SKILL.md:116 SKILL.md:117 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:116 SKILL.md:117 SKILL.md:122 SKILL.md:123 SKILL.md:124 testing-skills-with-subagents.md:148
⚡ Contains scripts (1)
Audited by: codex
Jul 7, 2026, 04:50 AM
Most static findings are false positives from Markdown examples, inline code, and documented configuration paths. The bundled Graphviz helper uses hardcoded commands and visible file writes, with no evidence of command injection, exfiltration, persistence, or prompt-injection text. A semantic concern remains because the skill teaches dual-use persuasion techniques for increasing agent compliance.
21
Files scanned
4,086
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
persuasion-principles.md:5-7persuasion-principles.md:153-165references/anti-rationalization/README.md:113-150
Dual-use Agent Compliance Persuasion Guidance
The skill teaches authors to use persuasion principles, strong authority language, and commitment framing to increase AI agent compliance. It includes ethical cautions, but the guidance could be adapted to override agent judgment outside user-approved quality workflows.
The cited files explicitly describe compliance-increasing persuasion techniques and also provide ethical boundaries. Confidence is high for dual-use content but lower than malicious because the stated purpose is quality enforcement.
Risk Factors
⚙️ External commands (57)
anthropic-best-practices.md:434-454 anthropic-best-practices.md:476-478 anthropic-best-practices.md:478-482 anthropic-best-practices.md:482-486 anthropic-best-practices.md:486-492 anthropic-best-practices.md:492-496 anthropic-best-practices.md:496-499 anthropic-best-practices.md:534-535 anthropic-best-practices.md:535-541 anthropic-best-practices.md:541-543 anthropic-best-practices.md:565-572 anthropic-best-practices.md:572-576 anthropic-best-practices.md:1082-1085 examples.md:70-71 examples.md:71-72 examples.md:96-97 examples.md:97-102 examples.md:113-116 examples.md:258 examples.md:263 gotchas.md:105-106 references/standards/README.md:15-20 references/tier-3-platform/README.md:72-81 render-graphs.js:18 render-graphs.js:25 render-graphs.js:72 render-graphs.js:112 render-graphs.js:10-22 render-graphs.js:22 render-graphs.js:30-55 render-graphs.js:58-61 render-graphs.js:67-106 render-graphs.js:106-124 render-graphs.js:124-128 render-graphs.js:128-140 render-graphs.js:140-142 render-graphs.js:142-145 render-graphs.js:145-147 render-graphs.js:147-156 render-graphs.js:156-158 render-graphs.js:158-160 render-graphs.js:160-165 SKILL.md:61 SKILL.md:68-82 SKILL.md:82-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-99 SKILL.md:99-100 SKILL.md:100-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-110 SKILL.md:110-115 SKILL.md:115-118 SKILL.md:118-121 SKILL.md:121-125
📁 Filesystem access (32)
anthropic-best-practices.md:870 gotchas.md:162 gotchas.md:165 gotchas.md:162 gotchas.md:165 gotchas.md:172 references/standards/README.md:14 references/standards/README.md:14 render-graphs.js:120 render-graphs.js:132 render-graphs.js:141 render-graphs.js:146 render-graphs.js:157 render-graphs.js:105 render-graphs.js:131 render-graphs.js:120 render-graphs.js:141 render-graphs.js:146 render-graphs.js:157 render-graphs.js:96 render-graphs.js:97 SKILL.md:116 SKILL.md:117 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:116 SKILL.md:117 SKILL.md:122 SKILL.md:123 SKILL.md:124 testing-skills-with-subagents.md:148
⚡ Contains scripts (1)
Audited by: codex
Jun 30, 2026, 08:21 PM
Static analysis reported many high-risk patterns, but most occur in markdown examples, documentation links, or terminology and are false positives. The confirmed runtime risk is a bundled Node.js helper that reads files, writes generated diagram files, and invokes Graphviz with a hardcoded command. No evidence found of credential exfiltration, malicious network calls, persistence, or prompt-injection text that tries to override this audit.
21
Files scanned
4,086
Lines analyzed
9
Review items
1
False positives ignored
Confirmed security concerns (2)
Low
Markdown Command Examples Trigger Static Alerts
Many external-command findings are markdown examples, shell snippets, or inline code used to teach skill creation. They are not automatically executed by the skill.
The cited locations are documentation snippets inside markdown files. They show examples for users and are not executable code paths.
Low
Home Directory Paths Are Instructional Examples
Hidden home-directory paths are used to explain where users may install OpenCode skills. The markdown examples do not read or write those paths automatically.
The paths appear in fenced documentation examples for skill placement. They are not connected to runtime code in the skill body.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Utility Script Executes Graphviz
The Node.js helper imports child_process and invokes the external Graphviz dot command. The command is hardcoded and receives DOT content through stdin, so command injection was not confirmed, but external tool execution requires user awareness.
The script clearly executes an external binary with execSync. The command string is fixed, which lowers injection risk but still creates runtime dependency and execution risk.
Medium
render-graphs.js:96-97render-graphs.js:120render-graphs.js:132render-graphs.js:141render-graphs.js:146render-graphs.js:157
Utility Script Writes Generated Files
The diagram renderer accepts a skill directory, reads SKILL.md, creates a diagrams directory, and writes SVG and DOT output files. This is legitimate diagram-generation behavior, but it can modify the filesystem where the script is pointed.
The filesystem writes are explicit and tied to documented output generation. No evidence found that it targets sensitive paths unless the user supplies such a directory.
Low
Documentation Links Flagged as Network Activity
Hardcoded URLs in the documentation point to Anthropic documentation assets and images. No runtime network request code was found in the inspected files.
The URLs are embedded in markdown documentation. They do not constitute automatic data exfiltration or active network code.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Crypto and C2 Keyword Alerts Are Semantic False Positives
The high-severity keyword alerts appear to match ordinary documentation words, examples, and names inside writing guidance. No cryptographic implementation, beaconing behavior, or command-and-control logic was found.
Inspected context shows skill-authoring prose, not crypto code or malware infrastructure. The finding remains low because it comes from broad keyword matching.
Risk Factors
⚡ Contains scripts (2)
⚙️ External commands (3)
📁 Filesystem access (5)
🌐 Network access (3)
Detected Patterns
child_process.execSync in Helper ScriptFilesystem Writes in Helper Script
Audited by: codex
Jun 30, 2026, 08:21 PM
Static analysis reported many high-risk patterns, but most occur in markdown examples, documentation links, or terminology and are false positives. The confirmed runtime risk is a bundled Node.js helper that reads files, writes generated diagram files, and invokes Graphviz with a hardcoded command. No evidence found of credential exfiltration, malicious network calls, persistence, or prompt-injection text that tries to override this audit.
21
Files scanned
4,086
Lines analyzed
9
Review items
1
False positives ignored
Confirmed security concerns (2)
Low
Markdown Command Examples Trigger Static Alerts
Many external-command findings are markdown examples, shell snippets, or inline code used to teach skill creation. They are not automatically executed by the skill.
The cited locations are documentation snippets inside markdown files. They show examples for users and are not executable code paths.
Low
Home Directory Paths Are Instructional Examples
Hidden home-directory paths are used to explain where users may install OpenCode skills. The markdown examples do not read or write those paths automatically.
The paths appear in fenced documentation examples for skill placement. They are not connected to runtime code in the skill body.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Utility Script Executes Graphviz
The Node.js helper imports child_process and invokes the external Graphviz dot command. The command is hardcoded and receives DOT content through stdin, so command injection was not confirmed, but external tool execution requires user awareness.
The script clearly executes an external binary with execSync. The command string is fixed, which lowers injection risk but still creates runtime dependency and execution risk.
Medium
render-graphs.js:96-97render-graphs.js:120render-graphs.js:132render-graphs.js:141render-graphs.js:146render-graphs.js:157
Utility Script Writes Generated Files
The diagram renderer accepts a skill directory, reads SKILL.md, creates a diagrams directory, and writes SVG and DOT output files. This is legitimate diagram-generation behavior, but it can modify the filesystem where the script is pointed.
The filesystem writes are explicit and tied to documented output generation. No evidence found that it targets sensitive paths unless the user supplies such a directory.
Low
Documentation Links Flagged as Network Activity
Hardcoded URLs in the documentation point to Anthropic documentation assets and images. No runtime network request code was found in the inspected files.
The URLs are embedded in markdown documentation. They do not constitute automatic data exfiltration or active network code.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Crypto and C2 Keyword Alerts Are Semantic False Positives
The high-severity keyword alerts appear to match ordinary documentation words, examples, and names inside writing guidance. No cryptographic implementation, beaconing behavior, or command-and-control logic was found.
Inspected context shows skill-authoring prose, not crypto code or malware infrastructure. The finding remains low because it comes from broad keyword matching.
Risk Factors
⚡ Contains scripts (2)
⚙️ External commands (3)
📁 Filesystem access (5)
🌐 Network access (3)
Detected Patterns
child_process.execSync in Helper ScriptFilesystem Writes in Helper Script
Audited by: codex
Feb 25, 2026, 10:48 AM
This is a documentation and reference skill providing guidance on writing AI agent skills. All static findings are false positives - the scanner detected patterns in markdown documentation (code formatting with backticks, mentions of cryptographic terms, URLs in documentation) rather than actual executable code. The render-graphs.js is a build script for documentation generation, not runtime functionality.
21
Files scanned
4,088
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude