📦

Audit History

event-store-design - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v7 LatestJul 7, 2026, 07:58 AM No confirmed findings0No capability change
v6 Jul 7, 2026, 07:58 AM No confirmed findings0External commands
v5 Jul 1, 2026, 12:33 AM 2 confirmed1 External commands
v4 Jan 17, 2026, 08:51 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 08:51 AM No confirmed findings0Network accessExternal commands
v2 Jan 4, 2026, 04:19 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 04:19 PM No confirmed findings0Baseline

Jul 7, 2026, 07:58 AM

All static findings appear to be false positives from Markdown fences, database query examples, resource links, and event-store schema terms. No prompt injection, exfiltration intent, or malicious behavior was found in SKILL.md.

1
Files scanned
436
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 7, 2026, 07:58 AM

All static findings appear to be false positives from Markdown fences, database query examples, resource links, and event-store schema terms. No prompt injection, exfiltration intent, or malicious behavior was found in SKILL.md.

1
Files scanned
436
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 1, 2026, 12:33 AM

AI review downgraded the static risk score after checking SKILL.md. The backtick, weak cryptography, reconnaissance, and fetch detections are false positives from markdown fences, documentation text, schema examples, database calls, and public reference links. One medium issue remains because the EventStoreDB example disables TLS for a localhost URI, which needs a publication warning for production use.

1
Files scanned
436
Lines analyzed
4
Review items
2
False positives ignored

Confirmed security concerns (2)

Medium
Example EventStoreDB Connection Disables TLS
The EventStoreDB template shows a connection URI with tls=false. This is reasonable for a local development endpoint, but users could copy it into production and send event data over an unencrypted connection.
The insecure setting is explicit, but the URI targets localhost. The risk depends on whether users adapt the example for non-local deployments without changing TLS settings.
Low
Reconnaissance Detections Are Schema And Example Identifiers
Verdict: FALSE_POSITIVE. The system reconnaissance detections map to SQL column names, index names, UUID imports, and query placeholders in event store examples. No evidence found of host enumeration, process inspection, or environment reconnaissance behavior.
The surrounding context shows data model fields and parameterized database examples. None of the locations include commands that inspect the local system or collect host metadata.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Network Detections Are Database Examples And Documentation Links
Verdict: FALSE_POSITIVE for exfiltration. The fetch detections are asyncpg database reads inside an illustrative Python template, and the URLs are public documentation resources. No evidence found of hidden outbound requests, credential transfer, or unauthorized data collection.
The method calls are SQL client calls on a database connection, not browser fetch or HTTP exfiltration. The hardcoded URLs are visible reference links at the end of the document.
Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
External Command Detections Are Markdown Fence False Positives
Verdict: FALSE_POSITIVE. The Ruby/shell backtick detections point to markdown code fence delimiters around diagrams and examples, not executable shell commands. No evidence found of command execution logic in SKILL.md.
The flagged lines are markdown fence delimiters or boundaries of fenced examples. They are not interpreted as Ruby backticks or shell execution by the skill runtime.
Low
Weak Cryptography Detections Are Text Substring False Positives
Verdict: FALSE_POSITIVE. The weak cryptography detections occur in ordinary documentation text such as the skill name, description, headings, and table labels. No cryptographic implementation or weak algorithm usage was found in the reviewed file.
The flagged text is natural language related to design and descriptions. There is no crypto API, cipher selection, hashing function, or key handling code at these locations.

Risk Factors

Detected Patterns

Example EventStoreDB Connection Disables TLS
Audited by: codex

Jan 17, 2026, 08:51 AM

Documentation-only skill containing architectural guidance, technology comparisons, and code templates for event store design. No executable code, scripts, network calls, or external command execution. Static findings are false positives: C2 flag from GitHub URL, cryptographic flags from ASCII diagram characters, shell backticks from SQL identifiers.

2
Files scanned
612
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 17, 2026, 08:51 AM

Documentation-only skill containing architectural guidance, technology comparisons, and code templates for event store design. No executable code, scripts, network calls, or external command execution. Static findings are false positives: C2 flag from GitHub URL, cryptographic flags from ASCII diagram characters, shell backticks from SQL identifiers.

2
Files scanned
612
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 4, 2026, 04:19 PM

Documentation-only skill with no executable code. The SKILL.md file contains architectural guidance, technology comparisons, and code templates. No scripts, network calls, filesystem access, environment variable reads, or external command execution.

4
Files scanned
656
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 4, 2026, 04:19 PM

Documentation-only skill with no executable code. The SKILL.md file contains architectural guidance, technology comparisons, and code templates. No scripts, network calls, filesystem access, environment variable reads, or external command execution.

4
Files scanned
656
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude