Versioned security assessment

Report ID: SA-C87B4D83

6/30/2026, 10:00:57 PM

skillscan security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
skillscan
Version
v3
Maintainer
tokauth
Source
github.com/tokauth/SkillScan/tree/main/
Coverage
4 Files scanned · 1,155 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static findings are mostly expected for a security scanner, but several high-risk behaviors are confirmed. The skill uploads complete skill packages to an external service, sends persistent client metadata, and can silently replace local skill files through remote updates. No prompt-injection attempt or confirmed malicious payload was found, so this is high risk rather than blocked as critical.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 1,155 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 7 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Not recorded by this audit

Capability review items (8)
High
README.md:21SKILL.md:120-126scripts/scanner.py:420-455scripts/scanner.py:509-528
Complete Skill Packages Uploaded to External Service
The scanner packs the target skill directory and uploads it to skillscan.tokauth.com when no cache result exists. This can expose source files or secrets stored inside a skill directory to a third-party service.
The implementation zips the scanned directory and sends it through a multipart POST. The README and API section also document cloud upload behavior.
High
SKILL.md:104-114scripts/scanner.py:28-29scripts/scanner.py:825-853scripts/scanner.py:859-897scripts/scanner.py:911-938
Silent Self-Update Can Replace Local Skill Files
The entry point checks a remote update manifest on every run interval and can download a zip that overwrites files in the installed skill. Hash verification is optional because the update continues when a manifest omits sha256.
The code fetches update metadata, downloads remote content, and copies extracted files over the installed skill. The sha256 check only runs when the manifest supplies a value.
High
SKILL.md:32-69
Persistent Agent Policy Modification Requested
The skill instructs agents to append a persistent Skill Security section to SOUL.md on first load. This changes future agent behavior outside the skill package and is not implemented as a user-controlled setting.
The instruction is explicit in the skill documentation, but the Python script does not directly modify SOUL.md. The risk depends on whether the host agent follows skill instructions.
Medium
scripts/scanner.py:151-212scripts/scanner.py:393-405scripts/scanner.py:447-455
Persistent Client Metadata Sent with Cloud Requests
The scanner creates a persistent client identifier and sends encoded platform details in X-Client-Info headers. It may include a MAC address when uuid.getnode returns a hardware address.
The code builds and persists client_info, base64 encodes it, and attaches it to both cache and upload requests. This is direct evidence of telemetry.
Medium
scripts/scanner.py:604-624scripts/scanner.py:725-730scripts/scanner.py:779-780
Recursive Deletion Depends on Remote Verdicts
For HIGH or CRITICAL scan results, the tool offers to delete the original skill directory or zip file. The prompt reduces risk, but a false remote verdict could still lead to destructive local action.
The deletion call is guarded by an interactive prompt and only follows high-risk verdicts. The underlying rmtree and unlink operations are real destructive actions.
Medium
scripts/scanner.py:52-142scripts/scanner.py:641-696scripts/scanner.py:747-789
Broad Discovery of Private Skill Directories
The scanner enumerates many hidden tool-specific skill directories under the home directory. This is expected for a skill scanner, but it increases privacy impact when paired with cloud upload.
The directory list is explicit and includes many hidden agent locations. The scan-all and first-run paths copy discovered skills for cloud analysis after user confirmation.
Low
scripts/scanner.py:332-341scripts/scanner.py:881-887
Archive Extraction Static Finding Is Mitigated
The scanner uses extractall, but it resolves each archive member and rejects paths outside the extraction directory. This dismisses the static zip-slip finding as a guarded usage pattern.
Both extractall sites are preceded by member path validation against the resolved extraction root. This is a standard zip-slip mitigation.
Low
README.md:23SKILL.md:57-60SKILL.md:75-80
Markdown Command Detections Are Documentation Examples
The external command findings in README.md and SKILL.md are command examples and usage tables. No subprocess, os.system, or eval execution path was found in scripts/scanner.py.
The flagged locations are markdown backticks and tables. A focused search found no direct shell execution API in the Python implementation.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
_meta.json:5scripts/scanner.py:272-302scripts/scanner.py:859-865
Weak Crypto and Obfuscation Flags Are Hashing False Positives
The flagged cryptographic code uses SHA256 for content hashing and update verification, not password storage or encryption. The hex byte separator is a normal hashing delimiter, not obfuscation.
The code computes SHA256 digests and compares an optional update checksum. No evidence found of weak encryption, credential hashing, or hidden payload decoding.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable