📦

Audit History

auth-implementation-patterns - 8 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v8 LatestJul 7, 2026, 07:47 AM 1 confirmed0No capability change
v7 Jul 7, 2026, 07:47 AM 1 confirmed0External commands
v6 Jun 30, 2026, 09:58 PM No confirmed findings2No capability change
v5 Jun 30, 2026, 09:58 PM No confirmed findings2 External commands
v4 Jan 17, 2026, 07:22 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 07:22 AM No confirmed findings0External commandsEnv variables
v2 Jan 4, 2026, 04:47 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 04:47 PM No confirmed findings0Baseline

Jul 7, 2026, 07:47 AM

The static shell, environment, sensitive file, and reconnaissance findings are false positives caused by Markdown fences and non-executed TypeScript examples. No prompt injection or malicious exfiltration intent was found. One content-level issue remains: the OAuth example places an access token in a URL query string.

1
Files scanned
635
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Access Token Exposed in OAuth Callback URL
The OAuth example redirects the access token in the URL query string. Access tokens in URLs can leak through browser history, server logs, analytics, and referrer headers.
Line 345 explicitly appends tokens.accessToken to the callback URL. This is a recognized OAuth implementation risk, although it appears to be insecure guidance rather than malicious intent.
Audited by: codex

Jul 7, 2026, 07:47 AM

The static shell, environment, sensitive file, and reconnaissance findings are false positives caused by Markdown fences and non-executed TypeScript examples. No prompt injection or malicious exfiltration intent was found. One content-level issue remains: the OAuth example places an access token in a URL query string.

1
Files scanned
635
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Access Token Exposed in OAuth Callback URL
The OAuth example redirects the access token in the URL query string. Access tokens in URLs can leak through browser history, server logs, analytics, and referrer headers.
Line 345 explicitly appends tokens.accessToken to the callback URL. This is a recognized OAuth implementation risk, although it appears to be insecure guidance rather than malicious intent.
Audited by: codex

Jun 30, 2026, 09:58 PM

The static shell-execution, browser credential, browser storage, weak cryptography, and reconnaissance findings are false positives caused by Markdown code fences, auth terminology, and best-practice text. The skill contains no executable script files, but one OAuth example redirects an access token in a URL query string, which is unsafe implementation guidance. Publication is acceptable with a warning or content correction.

1
Files scanned
635
Lines analyzed
3
Review items
1
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
OAuth Access Token Exposed in Redirect URL
The OAuth callback example redirects to the frontend with an access token in the query string. URL tokens can leak through browser history, logs, referrer headers, analytics, and support screenshots.
The code directly builds a redirect URL containing token=${tokens.accessToken}. This is unsafe guidance, although it is documentation content rather than executable marketplace code.
Low
Environment Variables Used in Example Code
The skill references secrets and connection strings through process.env in TypeScript examples. This is normal configuration guidance and not evidence of exfiltration, but users should avoid pasting real secrets into prompts.
The references are visible in documentation examples and are not read by executable skill code. The concern is limited to user handling of real secret values.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Analyzer False Positives
The reported shell execution, browser credential access, browser storage access, weak cryptography, and reconnaissance patterns do not show malicious behavior in context. The evidence maps to Markdown fences, auth examples, and warnings such as avoiding JWT in localStorage.
Manual review found no shell command execution, browser credential file paths, weak cryptographic algorithms, or prompt injection text. The flagged text is explanatory Markdown and TypeScript sample code.

Detected Patterns

Access Token in URL Query Parameter
Audited by: codex

Jun 30, 2026, 09:58 PM

The static shell-execution, browser credential, browser storage, weak cryptography, and reconnaissance findings are false positives caused by Markdown code fences, auth terminology, and best-practice text. The skill contains no executable script files, but one OAuth example redirects an access token in a URL query string, which is unsafe implementation guidance. Publication is acceptable with a warning or content correction.

1
Files scanned
635
Lines analyzed
3
Review items
1
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
OAuth Access Token Exposed in Redirect URL
The OAuth callback example redirects to the frontend with an access token in the query string. URL tokens can leak through browser history, logs, referrer headers, analytics, and support screenshots.
The code directly builds a redirect URL containing token=${tokens.accessToken}. This is unsafe guidance, although it is documentation content rather than executable marketplace code.
Low
Environment Variables Used in Example Code
The skill references secrets and connection strings through process.env in TypeScript examples. This is normal configuration guidance and not evidence of exfiltration, but users should avoid pasting real secrets into prompts.
The references are visible in documentation examples and are not read by executable skill code. The concern is limited to user handling of real secret values.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Analyzer False Positives
The reported shell execution, browser credential access, browser storage access, weak cryptography, and reconnaissance patterns do not show malicious behavior in context. The evidence maps to Markdown fences, auth examples, and warnings such as avoiding JWT in localStorage.
Manual review found no shell command execution, browser credential file paths, weak cryptographic algorithms, or prompt injection text. The flagged text is explanatory Markdown and TypeScript sample code.

Detected Patterns

Access Token in URL Query Parameter
Audited by: codex

Jan 17, 2026, 07:22 AM

Pure documentation skill containing authentication code examples. All code is illustrative TypeScript demonstrating secure patterns (bcrypt with 12 rounds, JWT, proper cookie flags). No executable code, shell commands, network calls, or file system access beyond reading its own files. Static findings are false positives triggered by markdown code block backticks, environment variable references in examples, and security library mentions. The previous audit correctly identified this as safe.

2
Files scanned
810
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 17, 2026, 07:22 AM

Pure documentation skill containing authentication code examples. All code is illustrative TypeScript demonstrating secure patterns (bcrypt with 12 rounds, JWT, proper cookie flags). No executable code, shell commands, network calls, or file system access beyond reading its own files. Static findings are false positives triggered by markdown code block backticks, environment variable references in examples, and security library mentions. The previous audit correctly identified this as safe.

2
Files scanned
810
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 4, 2026, 04:47 PM

Pure documentation skill containing only code examples and patterns. No executable scripts, network calls, file system access beyond its own files, or external commands. All code snippets are illustrative and demonstrate authentication patterns without any malicious capabilities.

4
Files scanned
1,109
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 4, 2026, 04:47 PM

Pure documentation skill containing only code examples and patterns. No executable scripts, network calls, file system access beyond its own files, or external commands. All code snippets are illustrative and demonstrate authentication patterns without any malicious capabilities.

4
Files scanned
1,109
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude