Versioned security assessment

Report ID: SA-CD90E19F

6/30/2026, 9:33:22 PM

jeo security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: jeo
Version: v2
Maintainer: supercent-io
Source: github.com/supercent-io/skills-template/tree/main/.agent-skills/jeo/
Coverage: 19 Files scanned · 5,560 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

High

8 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis findings are largely true positives for invasive automation: the skill contains shell installers, Python and Bash hooks, networked local services, and writes to AI tool configuration under home directories. I found no evidence of credential exfiltration or confirmed malicious intent, but the skill should not be published without manual review and strong warnings because it can modify user projects and AI tool behavior.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

19 Files scanned · 5,560 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 5 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (8)

RISK-001 High

scripts/install.sh:70-75 scripts/install.sh:127-131 scripts/install.sh:164-166

Remote installers and eval-backed command execution

The installer runs commands through eval and includes remote install patterns such as a curl response piped to bash. This is dangerous because a network or upstream compromise can execute arbitrary code on the user system during setup.

The static shell-execution and pipe-to-shell findings are confirmed by installer logic. The behavior is declared as setup automation, but the execution surface is still high risk.

RISK-002 High

scripts/setup-claude.sh:40-55 scripts/setup-claude.sh:74-94 scripts/setup-codex.sh:18-20 scripts/setup-codex.sh:535-648 scripts/setup-gemini.sh:37-50 scripts/setup-opencode.sh:47-59

AI tool configuration and hook installation in home directories

Setup scripts write to Claude, Codex, Gemini, and OpenCode configuration paths under the user home directory. They register hooks and MCP servers that can run commands during AI tool events.

Multiple setup scripts directly target hidden AI tool configuration files and install persistent hooks. This confirms the filesystem and external-command risk factors in a semantically meaningful way.

RISK-003 High

scripts/setup-codex.sh:435-478 scripts/setup-codex.sh:483-520 scripts/claude-agentation-submit-hook.py:88-105 scripts/claude-agentation-submit-hook.py:118-136

Event hooks execute workflow scripts and poll localhost services

Codex and Claude hooks react to AI tool events, execute local workflow scripts, and query a localhost annotation service. This can affect future AI sessions and expose local workflow data to any process serving the expected local endpoint.

The hooks are explicit and bounded to local workflow states, but they still create persistent execution paths tied to AI tool lifecycle events.

RISK-004 High

scripts/ensure-agentation.sh:85-99 scripts/ensure-agentation.sh:156-225 scripts/ensure-agentation.sh:256-257

Project source mutation and package installation for UI annotation

The agentation helper can install an npm package and rewrite React entry files to mount an annotation component. This can alter application source code and dependency trees without a narrow allowlist.

The file clearly installs dependencies and edits source files. The purpose is documented, but the behavior is high impact for marketplace users.

RISK-005 Medium

scripts/setup-codex.sh:156-185

Prompt-like mode instruction is installed into Codex prompts

The Codex setup writes a prompt that tells the assistant it is operating in JEO mode and mandates workflow steps. This is not an audit-bypass prompt, but it can strongly steer future assistant behavior.

The suspicious phrase is present and installed as a user prompt. It does not claim special marketplace authority or tell auditors to skip review, so medium severity is appropriate.

RISK-006 Medium

scripts/plannotator-plan-loop.sh:280-309 scripts/plannotator-plan-loop.sh:323-343 scripts/setup-codex.sh:498-500 opencode.json.jeo.bak:7-18

Local network services are required for plan and annotation flows

The skill probes and connects to localhost ports for plannotator and agentation workflows. Localhost use is expected, but another local process could spoof responses or receive workflow data.

The networking is local and aligned with the skill purpose. The risk remains meaningful because hooks trust localhost service behavior.

RISK-007 Medium

references/FLOW.md:442-452

Forced worktree deletion guidance

The flow reference recommends forced worktree removal and recursive directory deletion during troubleshooting. This is documentation rather than executed code, but it can cause data loss if followed incorrectly.

The static recursive-delete hit is confirmed in documentation. It is not automatic execution, which lowers severity.

RISK-008 Low

scripts/check-status.sh:43-57 scripts/check-status.sh:105-141 scripts/claude-agentation-submit-hook.py:31-41

System reconnaissance is mostly prerequisite and status checking

Commands such as command detection, git root lookup, and settings inspection are used to check prerequisites and workflow state. No evidence found that these checks are used for stealth or evasion.

The reconnaissance patterns are real, but the surrounding code shows diagnostic and path-discovery use. This is a low-risk true positive in context.

Needs review findings (1)

REVIEW-001 Low

scripts/install.sh:114-116 scripts/install.sh:164-169 scripts/setup-codex.sh:498-500 references/FLOW.md:455-465

Hardcoded URLs are mostly documented install or localhost endpoints

Hardcoded URL findings are present in install instructions, local annotation endpoints, and tool configuration. They are not evidence of exfiltration by themselves.

The URLs are visible and related to declared integrations. They still contribute to the overall risk because setup automation can contact external and local services.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)

Low

scripts/setup-codex.sh:337-347

Weak hash findings are non-security session identifiers

Several weak-crypto static findings relate to MD5 use for deterministic temporary directory names. I did not find evidence that these hashes protect secrets or validate integrity.

The code uses MD5 to derive a short local session key from the current directory. That is weak for security, but this context appears non-cryptographic.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable