📦

Audit History

bazel-build-optimization - 8 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v8 LatestJul 7, 2026, 08:02 AM No confirmed findings0No capability change
v7 Jul 7, 2026, 08:02 AM No confirmed findings0No capability change
v6 Jun 30, 2026, 10:10 PM No confirmed findings2No capability change
v5 Jun 30, 2026, 10:10 PM No confirmed findings2No capability change
v4 Jan 17, 2026, 07:37 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 07:37 AM No confirmed findings0Network accessExternal commandsFilesystem access
v2 Jan 4, 2026, 04:49 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 04:49 PM No confirmed findings0Baseline

Jul 7, 2026, 08:02 AM

The static findings were reviewed in context and appear to be documentation examples, not executable skill code. No prompt injection, credential exfiltration, or unsafe filesystem behavior was found in SKILL.md. The command, URL, cache path, and mnemonic matches are false positives from Markdown examples.

1
Files scanned
386
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex

Jul 7, 2026, 08:02 AM

The static findings were reviewed in context and appear to be documentation examples, not executable skill code. No prompt injection, credential exfiltration, or unsafe filesystem behavior was found in SKILL.md. The command, URL, cache path, and mnemonic matches are false positives from Markdown examples.

1
Files scanned
386
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex

Jun 30, 2026, 10:10 PM

Static analysis flagged command, network, filesystem, crypto, and obfuscation patterns in SKILL.md. Review found these are documentation examples, Bazel templates, placeholder service URLs, checksum fields, and local cache paths, with no evidence of malicious execution or data exfiltration.

1
Files scanned
386
Lines analyzed
5
Review items
2
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Documented Shell Commands Require User Review
The skill includes Bazel, Git, sed, tr, dot, and wc command examples. These are relevant build-analysis commands, but users should inspect targets and repository state before running them.
The commands are visible documentation examples for Bazel workflows, not hidden code. They can still affect local files or consume resources when a user chooses to execute them.
Low
Remote Build Service Placeholders
The skill shows remote cache, remote execution, and build event service endpoints using example hostnames. This is normal Bazel configuration guidance, but users must replace placeholders with trusted internal services.
The endpoints are example domains in a .bazelrc template and are labeled as optional remote caching or execution settings. I found no evidence that the skill sends data to these hosts by itself.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Local Home Cache Paths
The skill recommends Bazel disk and repository cache paths under the user's home cache directory. This is a normal local performance pattern, not credential access.
The paths point to Bazel cache directories and do not reference secrets or credential files. The static hidden-file warning is a false positive in this context.
Low
Static Crypto Signals Are False Positives
The static analyzer flagged crypto-related terms, but the reviewed content uses sha256 as dependency integrity metadata and mnemonic as a Bazel action label. No private key or seed handling was found.
The reviewed lines contain table text, dependency checksum fields, and a Bazel mnemonic field. I did not find evidence of weak cryptographic use or secret material processing.

Detected Patterns

Shell Command Substitution in ExampleBazel Action Execution Template
Audited by: codex

Jun 30, 2026, 10:10 PM

Static analysis flagged command, network, filesystem, crypto, and obfuscation patterns in SKILL.md. Review found these are documentation examples, Bazel templates, placeholder service URLs, checksum fields, and local cache paths, with no evidence of malicious execution or data exfiltration.

1
Files scanned
386
Lines analyzed
5
Review items
2
False positives ignored
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Documented Shell Commands Require User Review
The skill includes Bazel, Git, sed, tr, dot, and wc command examples. These are relevant build-analysis commands, but users should inspect targets and repository state before running them.
The commands are visible documentation examples for Bazel workflows, not hidden code. They can still affect local files or consume resources when a user chooses to execute them.
Low
Remote Build Service Placeholders
The skill shows remote cache, remote execution, and build event service endpoints using example hostnames. This is normal Bazel configuration guidance, but users must replace placeholders with trusted internal services.
The endpoints are example domains in a .bazelrc template and are labeled as optional remote caching or execution settings. I found no evidence that the skill sends data to these hosts by itself.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Local Home Cache Paths
The skill recommends Bazel disk and repository cache paths under the user's home cache directory. This is a normal local performance pattern, not credential access.
The paths point to Bazel cache directories and do not reference secrets or credential files. The static hidden-file warning is a false positive in this context.
Low
Static Crypto Signals Are False Positives
The static analyzer flagged crypto-related terms, but the reviewed content uses sha256 as dependency integrity metadata and mnemonic as a Bazel action label. No private key or seed handling was found.
The reviewed lines contain table text, dependency checksum fields, and a Bazel mnemonic field. I did not find evidence of weak cryptographic use or secret material processing.

Detected Patterns

Shell Command Substitution in ExampleBazel Action Execution Template
Audited by: codex

Jan 17, 2026, 07:37 AM

This is a pure documentation skill containing only instructional markdown content. No executable code, scripts, or functions exist. Static findings are false positives triggered by documentation patterns: 'sha256' in http_archive() calls are integrity checksums for dependency downloads (security best practice), backticks are Markdown code fences, and URL references are documentation links. No file system access, network calls, or command execution capabilities exist.

2
Files scanned
561
Lines analyzed
3
Review items
0
False positives ignored
Audited by: claude

Jan 17, 2026, 07:37 AM

This is a pure documentation skill containing only instructional markdown content. No executable code, scripts, or functions exist. Static findings are false positives triggered by documentation patterns: 'sha256' in http_archive() calls are integrity checksums for dependency downloads (security best practice), backticks are Markdown code fences, and URL references are documentation links. No file system access, network calls, or command execution capabilities exist.

2
Files scanned
561
Lines analyzed
3
Review items
0
False positives ignored
Audited by: claude

Jan 4, 2026, 04:49 PM

Pure documentation skill with instructional templates for Bazel optimization. No executable code, no file system access, no network calls, no environment variable reading. Contains only markdown documentation and example Bazel configuration patterns.

4
Files scanned
605
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 4, 2026, 04:49 PM

Pure documentation skill with instructional templates for Bazel optimization. No executable code, no file system access, no network calls, no environment variable reading. Contains only markdown documentation and example Bazel configuration patterns.

4
Files scanned
605
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude