Audit History

Version	Date	Result	Review items	Change vs previous
v5 Latest	Jul 9, 2026, 07:49 AM	2 confirmed	14	No capability change
v4	Jul 9, 2026, 07:49 AM	2 confirmed	14	No capability change
v3	Jul 7, 2026, 05:47 AM	1 confirmed	14	Env variables Contains scripts
v2	Jun 30, 2026, 08:02 PM	2 confirmed	0	Contains scripts Env variables
v1	Mar 26, 2026, 04:07 AM	No confirmed findings	0	Baseline

Jul 9, 2026, 07:49 AM

Most high static secret detections are scanner regex definitions rather than embedded credentials. Real risks remain around .env scanning, redaction gaps, outbound marketplace submissions, sibling-directory command execution, and public repository publication.

5

Files scanned

574

Lines analyzed

20

Review items

0

False positives ignored

Confirmed security concerns (2)

High

scripts/public_skill_audit.py:32

Environment file access

".env",

The scanner treats .env files as text inputs while walking a user-supplied tree. That is audit-related, but it can process sensitive environment files and should redact output.

High

scripts/public_skill_audit.py:87-93 scripts/public_skill_audit.py:143-150 scripts/public_skill_audit.py:159-162

Secret Values May Be Printed in Audit Output

The audit script stores the matched source line in Finding.text and prints it in normal and JSON output. If a real key is found, the raw value can appear in logs or reports.

The code directly captures and prints full matched lines while scanning for API keys and private keys. The audit purpose is legitimate, but secret values should be masked.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:59

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py analyze /absolute/path/to/skill

The command references ../../skill-package and a user-supplied absolute path. It can execute code outside the skill directory, so the filesystem boundary risk is real.

High

SKILL.md:60

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py build /absolute/path/to/skill --mode public

The build command references ../../skill-package and writes a public package from a user-supplied source path. The sibling-directory execution risk is real.

High

SKILL.md:79

Path traversal sequence

python3 ../skill-creator/scripts/quick_validate.py /absolute/path/to/skill-marketplace-publisher

The validator command references ../skill-creator outside the skill package. It assumes a trusted sibling path and could execute unintended local code.

Medium

SKILL.md:40-42 SKILL.md:58-61 SKILL.md:78-80 SKILL.md:97-106 SKILL.md:118-122 SKILL.md:142-147

Ruby/shell backtick execution · 6 occurrences

```bash

The fenced block instructs running a local Python audit command on a user-supplied skill path. External command execution is explicit and should require user approval.

Low

scripts/submit_marketplace.py:10

Python HTTP libraries

import urllib.request

The script imports urllib and later uses it for outbound marketplace submissions. This enables transmission of repository URLs and optional user notes.

Low

scripts/submit_marketplace.py:18

Python HTTP libraries

request = urllib.request.Request(

The request object builds an outbound JSON POST with user-supplied fields. Network use is intended, but it should remain explicit to the user.

Low

scripts/submit_marketplace.py:28

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

This opens the outbound HTTP request to a configured endpoint with a timeout. It transmits submission data off-host by design.

Low

scripts/submit_marketplace.py:39

Hardcoded URL

response = post_json("https://skillstore.io/api/submit", payload)

This posts the repository URL and optional notes to the Skillstore API. The endpoint is legitimate for the workflow, but it is real external transmission.

Low

scripts/submit_marketplace.py:75

Hardcoded URL

response = post_json("https://skillmaps.net/v1/feedback", payload)

This posts a listing request and optional email to the SkillMap feedback endpoint. The network action is intended but sends user data externally.

Risk Factors

🔑 Env variables (4)

scripts/public_skill_audit.py:59 scripts/public_skill_audit.py:99 scripts/public_skill_audit.py:48 scripts/public_skill_audit.py:52

🌐 Network access (10)

scripts/submit_marketplace.py:10 scripts/submit_marketplace.py:18 scripts/submit_marketplace.py:28 scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:52 scripts/submit_marketplace.py:75 SKILL.md:111 SKILL.md:120 SKILL.md:128 SKILL.md:144

⚙️ External commands (45)

📁 Filesystem access (3)

SKILL.md:59 SKILL.md:60 SKILL.md:79

Audited by: codex

Audit version 4

Jul 9, 2026, 07:49 AM

Most high static secret detections are scanner regex definitions rather than embedded credentials. Real risks remain around .env scanning, redaction gaps, outbound marketplace submissions, sibling-directory command execution, and public repository publication.

5

Files scanned

574

Lines analyzed

20

Review items

0

False positives ignored

Confirmed security concerns (2)

High

scripts/public_skill_audit.py:32

Environment file access

".env",

The scanner treats .env files as text inputs while walking a user-supplied tree. That is audit-related, but it can process sensitive environment files and should redact output.

High

scripts/public_skill_audit.py:87-93 scripts/public_skill_audit.py:143-150 scripts/public_skill_audit.py:159-162

Secret Values May Be Printed in Audit Output

The audit script stores the matched source line in Finding.text and prints it in normal and JSON output. If a real key is found, the raw value can appear in logs or reports.

The code directly captures and prints full matched lines while scanning for API keys and private keys. The audit purpose is legitimate, but secret values should be masked.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:59

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py analyze /absolute/path/to/skill

The command references ../../skill-package and a user-supplied absolute path. It can execute code outside the skill directory, so the filesystem boundary risk is real.

High

SKILL.md:60

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py build /absolute/path/to/skill --mode public

The build command references ../../skill-package and writes a public package from a user-supplied source path. The sibling-directory execution risk is real.

High

SKILL.md:79

Path traversal sequence

python3 ../skill-creator/scripts/quick_validate.py /absolute/path/to/skill-marketplace-publisher

The validator command references ../skill-creator outside the skill package. It assumes a trusted sibling path and could execute unintended local code.

Medium

SKILL.md:40-42 SKILL.md:58-61 SKILL.md:78-80 SKILL.md:97-106 SKILL.md:118-122 SKILL.md:142-147

Ruby/shell backtick execution · 6 occurrences

```bash

The fenced block instructs running a local Python audit command on a user-supplied skill path. External command execution is explicit and should require user approval.

Low

scripts/submit_marketplace.py:10

Python HTTP libraries

import urllib.request

The script imports urllib and later uses it for outbound marketplace submissions. This enables transmission of repository URLs and optional user notes.

Low

scripts/submit_marketplace.py:18

Python HTTP libraries

request = urllib.request.Request(

The request object builds an outbound JSON POST with user-supplied fields. Network use is intended, but it should remain explicit to the user.

Low

scripts/submit_marketplace.py:28

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

This opens the outbound HTTP request to a configured endpoint with a timeout. It transmits submission data off-host by design.

Low

scripts/submit_marketplace.py:39

Hardcoded URL

response = post_json("https://skillstore.io/api/submit", payload)

This posts the repository URL and optional notes to the Skillstore API. The endpoint is legitimate for the workflow, but it is real external transmission.

Low

scripts/submit_marketplace.py:75

Hardcoded URL

response = post_json("https://skillmaps.net/v1/feedback", payload)

This posts a listing request and optional email to the SkillMap feedback endpoint. The network action is intended but sends user data externally.

Risk Factors

🔑 Env variables (4)

scripts/public_skill_audit.py:59 scripts/public_skill_audit.py:99 scripts/public_skill_audit.py:48 scripts/public_skill_audit.py:52

🌐 Network access (10)

scripts/submit_marketplace.py:10 scripts/submit_marketplace.py:18 scripts/submit_marketplace.py:28 scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:52 scripts/submit_marketplace.py:75 SKILL.md:111 SKILL.md:120 SKILL.md:128 SKILL.md:144

⚙️ External commands (45)

📁 Filesystem access (3)

SKILL.md:59 SKILL.md:60 SKILL.md:79

Audited by: codex

Audit version 3

Jul 7, 2026, 05:47 AM

Most secret-pattern and Markdown static hits are false positives from scanner signatures or formatting. Real risks remain in outbound marketplace submissions, public GitHub publishing commands, relative helper script execution, and audit output that can reveal matched secret lines.

5

Files scanned

574

Lines analyzed

19

Review items

1

False positives ignored

Confirmed security concerns (1)

High

scripts/public_skill_audit.py:86-93 scripts/public_skill_audit.py:143-147 scripts/public_skill_audit.py:159-162

Secret Audit Output Can Expose Matched Values

The audit script stores matched line text and prints it in reports. When a real secret is detected, logs or JSON output can reveal the secret-bearing line.

The code copies matching line text into Finding.text and emits findings through JSON and console output. The scanner targets secret patterns, so a true positive can leak the detected secret value.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:97-106

Ruby/shell backtick execution

```bash

This command block copies files, creates commits, and pushes a public GitHub repository. If run on the wrong artifact, it can publish unintended content.

High

SKILL.md:59

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py analyze /absolute/path/to/skill

The command executes packaging helpers through parent-directory paths outside the skill root. In a different install layout, that can execute unexpected local code.

High

SKILL.md:60

Path traversal sequence

python3 ../../skill-package/scripts/skill_package.py build /absolute/path/to/skill --mode public

The command executes packaging helpers through parent-directory paths outside the skill root. In a different install layout, that can execute unexpected local code.

High

SKILL.md:79

Path traversal sequence

python3 ../skill-creator/scripts/quick_validate.py /absolute/path/to/skill-marketplace-publisher

The command executes a validator through a parent-directory path outside the skill root. In a different install layout, that can execute unexpected local code.

Medium

SKILL.md:40-42 SKILL.md:58-61 SKILL.md:78-80 SKILL.md:118-122 SKILL.md:142-147

Ruby/shell backtick execution · 5 occurrences

```bash

This command block instructs the agent to run a local Python audit script against a user-supplied skill path. The command is intended, but it requires trusting the local script and path.

Low

scripts/submit_marketplace.py:10

Python HTTP libraries

import urllib.request

The urllib request code supports outbound POST requests to marketplace endpoints. It is intentional, but it creates a real external data-sharing surface.

Low

scripts/submit_marketplace.py:18

Python HTTP libraries

request = urllib.request.Request(

The urllib request code supports outbound POST requests to marketplace endpoints. It is intentional, but it creates a real external data-sharing surface.

Low

scripts/submit_marketplace.py:28

Python HTTP libraries

with urllib.request.urlopen(request, timeout=30) as response:

The urllib request code supports outbound POST requests to marketplace endpoints. It is intentional, but it creates a real external data-sharing surface.

Low

scripts/submit_marketplace.py:39

Hardcoded URL

response = post_json("https://skillstore.io/api/submit", payload)

The script posts the repository URL and optional notes to the Skillstore endpoint. This is expected publishing behavior, but it transmits user-provided data externally.

Low

scripts/submit_marketplace.py:75

Hardcoded URL

response = post_json("https://skillmaps.net/v1/feedback", payload)

The script posts listing request content and optional email to the SkillMap feedback endpoint. This is expected, but it shares user-provided data with a third party.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

scripts/public_skill_audit.py:58

SSH private key file

("secret_hub", re.compile(r"(ai-shared/secrets|\.secrets/|authorized_keys|id_rsa|id_ed25519)")),

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Risk Factors

🔑 Env variables (4)

scripts/public_skill_audit.py:59 scripts/public_skill_audit.py:99 scripts/public_skill_audit.py:48 scripts/public_skill_audit.py:52

🌐 Network access (10)

scripts/submit_marketplace.py:10 scripts/submit_marketplace.py:18 scripts/submit_marketplace.py:28 scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:52 scripts/submit_marketplace.py:75 SKILL.md:111 SKILL.md:120 SKILL.md:128 SKILL.md:144

⚙️ External commands (45)

📁 Filesystem access (3)

SKILL.md:59 SKILL.md:60 SKILL.md:79

Audited by: codex

Audit version 2

Jun 30, 2026, 08:02 PM

The static analyzer reported many high and critical patterns, but most are false positives from markdown backticks, marketplace URLs, regex definitions, and words such as SKILL.md. Confirmed risks are intentional: scripts read local skill files and submit user-provided repository or contact details to public marketplace endpoints, so use requires user consent and endpoint verification.

5

Files scanned

574

Lines analyzed

6

Review items

4

False positives ignored

Confirmed security concerns (2)

Medium

scripts/submit_marketplace.py:16-29 scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:69-75

Outbound Marketplace Submission Requests

The submit script posts repository URLs, notes, optional email addresses, and listing messages to Skillstore and SkillMap endpoints. This is expected for the skill, but it can disclose user-provided project and contact details if run without clear consent.

The code directly builds JSON payloads and sends POST requests to fixed external marketplace URLs. The behavior matches the skill purpose, so the risk is disclosure through intended operation rather than hidden exfiltration.

Medium

scripts/public_skill_audit.py:76-80 scripts/public_skill_audit.py:134-146 scripts/public_skill_audit.py:159-162

Recursive Local Skill File Reading

The audit script walks a user-supplied skill directory, reads text-like files, and prints detected secret-like lines. This is legitimate audit behavior, but findings may expose sensitive snippets in terminal logs or captured output.

The filesystem traversal and output of matching lines are explicit in the script. The code does not send this data over the network, but local output exposure is a real operational concern.

Static false positives ignored (4)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:40-42 SKILL.md:58-60 SKILL.md:97-105 SKILL.md:118-144 references/marketplaces.md:11-20

Markdown Command Examples Flagged as Execution

Many external-command findings occur in fenced documentation examples and marketplace notes. They are not executed by the skill automatically, but users should review commands before running publishing steps such as git, rsync, gh, and Python scripts.

The cited locations are markdown instructions or URL notes, not runtime shell execution. The only risk is if a user voluntarily runs documented commands without verifying paths and destinations.

Low

scripts/public_skill_audit.py:47-59 scripts/public_skill_audit.py:96-103

Secret and Environment Access Patterns Are Scanner Definitions

The reported private-key, API-key, dotenv, and SSH-file hits appear inside regex pattern definitions for the audit scanner. No evidence found that the script reads environment variables, imports dotenv, or contains real secret material.

The suspicious strings are compiled regular expressions used to detect secrets in other files. The script imports os for directory walking, but does not access os.environ or load dotenv files as configuration.

Low

agents/openai.yaml:3 SKILL.md:3 SKILL.md:71 references/marketplaces.md:22 scripts/public_skill_audit.py:124 scripts/submit_marketplace.py:89-90

Weak Cryptography Findings Are Text Matches

The weak-cryptography alerts point to descriptions, markdown references, argparse setup, or marketplace text. No evidence found of MD5, SHA1, DES, RC4, or other weak cryptographic operations in the cited files.

Manual review of the cited lines found user-facing text and parser construction, not cryptographic API calls. The scanner likely matched substrings such as md in SKILL.md or marketplace wording.

Low

SKILL.md:58-60 SKILL.md:78-80

Path Traversal Alerts Are Relative Path Examples

The path traversal findings are caused by documentation examples using relative paths to neighboring local tooling. They are not used in code to open attacker-controlled paths, although users should adjust paths for their own workspace.

The ../ sequences occur in markdown command examples, not in a file-access implementation. The actual audit script resolves the supplied root path and walks that directory intentionally.

Risk Factors

⚡ Contains scripts (2)

scripts/public_skill_audit.py:1-3 scripts/submit_marketplace.py:1-2

🌐 Network access (3)

scripts/submit_marketplace.py:16-29 scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:75

📁 Filesystem access (2)

scripts/public_skill_audit.py:76-80 scripts/public_skill_audit.py:129-140

⚙️ External commands (4)

SKILL.md:40-42 SKILL.md:58-60 SKILL.md:97-105 SKILL.md:118-144

Detected Patterns

Network POST to Third-Party Marketplace APIsRecursive File Inspection of User-Supplied Directory

Audited by: codex

Audit version 1

Mar 26, 2026, 04:07 AM

This skill is a legitimate security audit and marketplace publishing tool. Static analysis detected 126 patterns that are primarily false positives: (1) Pattern definitions in public_skill_audit.py designed to detect secrets were flagged as containing secrets, (2) Markdown backticks in documentation were misidentified as Ruby shell execution, (3) Public API endpoints for marketplace submission were flagged as hardcoded URLs. The skill performs local file auditing, makes outbound HTTP requests to public marketplace APIs, and uses shell commands for git operations - all appropriate for its intended purpose.

5

Files scanned

574

Lines analyzed

4

Review items

4

False positives ignored

Static false positives ignored (4)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Medium

SKILL.md:15-198 references/marketplaces.md:3-75

Static Scanner False Positive - Ruby Shell Execution

Static analyzer flagged 73 instances of 'Ruby/shell backtick execution' in SKILL.md and references/marketplaces.md. These are markdown code block delimiters showing bash command examples, not actual Ruby code execution. All flagged lines are in documentation files demonstrating workflow commands.

Verified file contents are markdown documentation with backtick-delimited code blocks, not Ruby source code. No executable Ruby files exist in the repository.

Low

scripts/public_skill_audit.py:47-60

Static Scanner False Positive - Pattern Definitions Detected as Threats

The public_skill_audit.py script contains regex patterns to detect secrets (SSH keys, API tokens, AWS keys). Static analysis flagged these pattern definitions as actual security threats. The script is a security detector, not a source of vulnerabilities.

Code review confirms lines 47-60 define HIGH_PATTERNS and MEDIUM_PATTERNS arrays containing compiled regex objects for secret detection, not actual secret values.

Low

scripts/submit_marketplace.py:39 scripts/submit_marketplace.py:75

Static Scanner False Positive - Hardcoded URLs

Public API endpoints for Skillstore (skillstore.io/api/submit) and SkillMap (skillmaps.net/v1/feedback) were flagged as hardcoded URLs. These are documented public marketplace submission endpoints required for the skill's core functionality.

URLs point to documented public API endpoints verified in references/marketplaces.md. No authentication credentials are embedded.

Low

SKILL.md:3 references/marketplaces.md:22

Static Scanner False Positive - Weak Cryptographic Algorithm

Multiple files were flagged for 'weak cryptographic algorithm'. These are false positives from pattern matching on documentation text and file extensions, not actual cryptographic implementations.

No cryptographic libraries imported or used. Flags triggered by text patterns in documentation, not actual crypto code.