📦
Audit History
gitops-workflow - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 9, 2026, 12:34 PM | No confirmed findings | 7 | No capability change |
| v8 | Jul 9, 2026, 12:34 PM | No confirmed findings | 7 | No capability change |
| v7 | Jul 7, 2026, 07:06 AM | No confirmed findings | 7 | No capability change |
| v6 | Jul 1, 2026, 12:50 AM | No confirmed findings | 5 | No capability change |
| v5 | Jul 1, 2026, 12:50 AM | No confirmed findings | 5 | No capability change |
| v4 | Jan 17, 2026, 09:03 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 09:03 AM | No confirmed findings | 0 | External commandsNetwork access |
| v2 | Jan 4, 2026, 04:25 PM | No confirmed findings | 0 | No capability change |
| v1 | Jan 4, 2026, 04:25 PM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 9, 2026, 12:34 PM
Most static findings are Markdown examples, YAML manifests, or expected public URLs. The main risk is the Flux installer that pipes network-fetched shell code into sudo. Some kubectl, argocd, flux, and kubeseal examples can change clusters or expose secrets.
3
Files scanned
553
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This fenced bash block includes a remote installer piped to sudo bash and Flux bootstrap commands that modify infrastructure. Although documented for Flux setup, it asks users or agents to execute privileged network-sourced shell code.
High
sudo privilege escalation
curl -s https://fluxcd.io/install.sh | sudo bash
The line explicitly pipes a remote installer from fluxcd.io into sudo bash. Running network-fetched shell code with elevated privileges is a real supply-chain and privilege-escalation risk.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
This fenced bash block instructs users to run kubectl commands that create a namespace, apply a remote manifest, and read an initial admin secret. It is legitimate GitOps guidance, but it can change a cluster and expose credentials if copied without review.
Medium
Hardcoded URL
curl -s https://fluxcd.io/install.sh | sudo bash
The URL is used in a curl pipeline that immediately executes remote content with sudo. The network target is not hidden, but this pattern carries supply-chain risk if copied directly.
Risk Factors
🌐 Network access (14)
⚙️ External commands (34)
SKILL.md:34-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-65 SKILL.md:65-69 SKILL.md:69-91 SKILL.md:91-95 SKILL.md:95-112 SKILL.md:112-118 SKILL.md:118-129 SKILL.md:129-133 SKILL.md:133-144 SKILL.md:144-148 SKILL.md:148-161 SKILL.md:161-168 SKILL.md:168-180 SKILL.md:180-183 SKILL.md:183-189 SKILL.md:189-191 SKILL.md:191-197 SKILL.md:197-212 SKILL.md:212-216 SKILL.md:216-222 SKILL.md:222-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-253 SKILL.md:253-271 SKILL.md:271-274 SKILL.md:274-277 SKILL.md:277-280 SKILL.md:280-284 SKILL.md:284-285 SKILL.md:120
Audited by: codex
Jul 9, 2026, 12:34 PM
Most static findings are Markdown examples, YAML manifests, or expected public URLs. The main risk is the Flux installer that pipes network-fetched shell code into sudo. Some kubectl, argocd, flux, and kubeseal examples can change clusters or expose secrets.
3
Files scanned
553
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This fenced bash block includes a remote installer piped to sudo bash and Flux bootstrap commands that modify infrastructure. Although documented for Flux setup, it asks users or agents to execute privileged network-sourced shell code.
High
sudo privilege escalation
curl -s https://fluxcd.io/install.sh | sudo bash
The line explicitly pipes a remote installer from fluxcd.io into sudo bash. Running network-fetched shell code with elevated privileges is a real supply-chain and privilege-escalation risk.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
This fenced bash block instructs users to run kubectl commands that create a namespace, apply a remote manifest, and read an initial admin secret. It is legitimate GitOps guidance, but it can change a cluster and expose credentials if copied without review.
Medium
Hardcoded URL
curl -s https://fluxcd.io/install.sh | sudo bash
The URL is used in a curl pipeline that immediately executes remote content with sudo. The network target is not hidden, but this pattern carries supply-chain risk if copied directly.
Risk Factors
🌐 Network access (14)
⚙️ External commands (34)
SKILL.md:34-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-65 SKILL.md:65-69 SKILL.md:69-91 SKILL.md:91-95 SKILL.md:95-112 SKILL.md:112-118 SKILL.md:118-129 SKILL.md:129-133 SKILL.md:133-144 SKILL.md:144-148 SKILL.md:148-161 SKILL.md:161-168 SKILL.md:168-180 SKILL.md:180-183 SKILL.md:183-189 SKILL.md:189-191 SKILL.md:191-197 SKILL.md:197-212 SKILL.md:212-216 SKILL.md:216-222 SKILL.md:222-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-253 SKILL.md:253-271 SKILL.md:271-274 SKILL.md:274-277 SKILL.md:277-280 SKILL.md:280-284 SKILL.md:284-285 SKILL.md:120
Audited by: codex
Jul 7, 2026, 07:06 AM
Most static findings are Markdown documentation examples for GitOps commands, YAML manifests, or expected public URLs. The main confirmed risk is the Flux install command that pipes network-fetched shell code into sudo, with additional operational risk from cluster-changing kubectl, argocd, flux, and kubeseal examples.
3
Files scanned
553
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This fenced bash block includes a remote installer piped to sudo bash and Flux bootstrap commands that modify infrastructure. Although documented for Flux setup, it asks users or agents to execute privileged network-sourced shell code.
High
sudo privilege escalation
curl -s https://fluxcd.io/install.sh | sudo bash
The line explicitly pipes a remote installer from fluxcd.io into sudo bash. Running network-fetched shell code with elevated privileges is a real supply-chain and privilege-escalation risk.
Medium
Ruby/shell backtick execution · 4 occurrences
```bash
This fenced bash block instructs users to run kubectl commands that create a namespace, apply a remote manifest, and read an initial admin secret. It is legitimate GitOps guidance, but it can change a cluster and expose credentials if copied without review.
Medium
Hardcoded URL
curl -s https://fluxcd.io/install.sh | sudo bash
The URL is used in a curl pipeline that immediately executes remote content with sudo. The network target is not hidden, but this pattern carries supply-chain risk if copied directly.
Risk Factors
🌐 Network access (14)
⚙️ External commands (34)
SKILL.md:34-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-65 SKILL.md:65-69 SKILL.md:69-91 SKILL.md:91-95 SKILL.md:95-112 SKILL.md:112-118 SKILL.md:118-129 SKILL.md:129-133 SKILL.md:133-144 SKILL.md:144-148 SKILL.md:148-161 SKILL.md:161-168 SKILL.md:168-180 SKILL.md:180-183 SKILL.md:183-189 SKILL.md:189-191 SKILL.md:191-197 SKILL.md:197-212 SKILL.md:212-216 SKILL.md:216-222 SKILL.md:222-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-253 SKILL.md:253-271 SKILL.md:271-274 SKILL.md:274-277 SKILL.md:277-280 SKILL.md:280-284 SKILL.md:284-285 SKILL.md:120
Audited by: codex
Jul 1, 2026, 12:50 AM
Static analysis reported many external command, network, sudo, and weak-crypto patterns. Review found these are Markdown GitOps examples, not executable skill code, with no evidence of prompt injection, malware, or data exfiltration. The skill still needs a publication warning because some examples can modify Kubernetes clusters, pass credentials on command lines, or run a network installer with sudo.
3
Files scanned
553
Lines analyzed
7
Review items
2
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Remote Installer Runs With Sudo
TRUE_POSITIVE: The Flux installation example pipes a script from a network URL directly into sudo bash. This is a real supply-chain and privilege-escalation risk if executed without verification, although it appears to be standard installation documentation rather than malicious code.
The exact command combines curl, a public install URL, and sudo bash on one line. Confidence is high because this pattern would execute remote code with elevated privileges if copied or run by an agent.
Medium
SKILL.md:34-42SKILL.md:122-128SKILL.md:248-250SKILL.md:271-279references/argocd-setup.md:6-30references/argocd-setup.md:66-81
Cluster-Mutating Commands In Examples
TRUE_POSITIVE: The guide includes kubectl, helm, argocd, flux, and kubeseal commands that can create namespaces, install controllers, sync applications, prune resources, or alter cluster state. These examples are legitimate for a GitOps skill, but an agent should not execute them without explicit user approval and cluster context.
The files show concrete operational commands in Markdown code blocks. The risk depends on execution context, so confidence is high for operational impact but not for malicious intent.
Medium
Token Passed As Command-Line Argument
TRUE_POSITIVE: The Argo CD repository example passes a password or token directly on the command line. This can expose credentials through shell history, process listings, or logs if used with a real secret.
The example explicitly uses --password token in a CLI command. It is a placeholder, but the pattern is unsafe when replaced with a real credential.
Medium
SKILL.md:85-90SKILL.md:167-180SKILL.md:276-279references/sync-policies.md:6-12references/sync-policies.md:50-63
Destructive Sync And Prune Options
TRUE_POSITIVE: The examples enable prune, self-heal, force sync, and automated reconciliation. These are valid GitOps controls, but misconfiguration can delete resources or overwrite emergency manual changes.
The documented settings are visible and can affect live cluster resources. They are normal GitOps features, so this is an operational safety concern rather than evidence of abuse.
Low
SKILL.md:39SKILL.md:79-83SKILL.md:104-108SKILL.md:120SKILL.md:141references/argocd-setup.md:8-18references/argocd-setup.md:72-80references/argocd-setup.md:94
Hardcoded Documentation URLs
TRUE_POSITIVE: The skill contains public Argo CD, Flux, GitHub, and Kubernetes service URLs. They are expected in setup examples, but they can trigger network access or fetch mutable upstream manifests if executed directly.
The URLs are directly present in installation and configuration examples. They point to expected project or placeholder endpoints, so the concern is low unless commands are executed blindly.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Are False Positives
FALSE_POSITIVE: The high static weak-cryptography alerts do not correspond to cryptographic algorithms or crypto API use. The cited lines contain GitOps principles, destination fields, service URLs, or placeholder configuration text.
Manual review found no MD5, SHA-1, DES, RC4, or cryptographic API usage at the cited locations. The scanner likely matched substrings inside ordinary YAML or prose.
Low
External Command Alerts Are Mostly Documentation
FALSE_POSITIVE: Most Ruby or shell backtick alerts are caused by Markdown code fences and inline code formatting, not Ruby execution. The files are guidance documents and contain no script wrapper that automatically runs these snippets.
The command text is inside Markdown fences and no executable Ruby or shell script file was present among the audited files. The residual risk is from user or agent execution, not hidden code execution.
Risk Factors
⚙️ External commands (7)
Detected Patterns
curl Piped To sudo bashCLI Secret ArgumentForce And Prune Operations
Audited by: codex
Jul 1, 2026, 12:50 AM
Static analysis reported many external command, network, sudo, and weak-crypto patterns. Review found these are Markdown GitOps examples, not executable skill code, with no evidence of prompt injection, malware, or data exfiltration. The skill still needs a publication warning because some examples can modify Kubernetes clusters, pass credentials on command lines, or run a network installer with sudo.
3
Files scanned
553
Lines analyzed
7
Review items
2
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Remote Installer Runs With Sudo
TRUE_POSITIVE: The Flux installation example pipes a script from a network URL directly into sudo bash. This is a real supply-chain and privilege-escalation risk if executed without verification, although it appears to be standard installation documentation rather than malicious code.
The exact command combines curl, a public install URL, and sudo bash on one line. Confidence is high because this pattern would execute remote code with elevated privileges if copied or run by an agent.
Medium
SKILL.md:34-42SKILL.md:122-128SKILL.md:248-250SKILL.md:271-279references/argocd-setup.md:6-30references/argocd-setup.md:66-81
Cluster-Mutating Commands In Examples
TRUE_POSITIVE: The guide includes kubectl, helm, argocd, flux, and kubeseal commands that can create namespaces, install controllers, sync applications, prune resources, or alter cluster state. These examples are legitimate for a GitOps skill, but an agent should not execute them without explicit user approval and cluster context.
The files show concrete operational commands in Markdown code blocks. The risk depends on execution context, so confidence is high for operational impact but not for malicious intent.
Medium
Token Passed As Command-Line Argument
TRUE_POSITIVE: The Argo CD repository example passes a password or token directly on the command line. This can expose credentials through shell history, process listings, or logs if used with a real secret.
The example explicitly uses --password token in a CLI command. It is a placeholder, but the pattern is unsafe when replaced with a real credential.
Medium
SKILL.md:85-90SKILL.md:167-180SKILL.md:276-279references/sync-policies.md:6-12references/sync-policies.md:50-63
Destructive Sync And Prune Options
TRUE_POSITIVE: The examples enable prune, self-heal, force sync, and automated reconciliation. These are valid GitOps controls, but misconfiguration can delete resources or overwrite emergency manual changes.
The documented settings are visible and can affect live cluster resources. They are normal GitOps features, so this is an operational safety concern rather than evidence of abuse.
Low
SKILL.md:39SKILL.md:79-83SKILL.md:104-108SKILL.md:120SKILL.md:141references/argocd-setup.md:8-18references/argocd-setup.md:72-80references/argocd-setup.md:94
Hardcoded Documentation URLs
TRUE_POSITIVE: The skill contains public Argo CD, Flux, GitHub, and Kubernetes service URLs. They are expected in setup examples, but they can trigger network access or fetch mutable upstream manifests if executed directly.
The URLs are directly present in installation and configuration examples. They point to expected project or placeholder endpoints, so the concern is low unless commands are executed blindly.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Are False Positives
FALSE_POSITIVE: The high static weak-cryptography alerts do not correspond to cryptographic algorithms or crypto API use. The cited lines contain GitOps principles, destination fields, service URLs, or placeholder configuration text.
Manual review found no MD5, SHA-1, DES, RC4, or cryptographic API usage at the cited locations. The scanner likely matched substrings inside ordinary YAML or prose.
Low
External Command Alerts Are Mostly Documentation
FALSE_POSITIVE: Most Ruby or shell backtick alerts are caused by Markdown code fences and inline code formatting, not Ruby execution. The files are guidance documents and contain no script wrapper that automatically runs these snippets.
The command text is inside Markdown fences and no executable Ruby or shell script file was present among the audited files. The residual risk is from user or agent execution, not hidden code execution.
Risk Factors
⚙️ External commands (7)
Detected Patterns
curl Piped To sudo bashCLI Secret ArgumentForce And Prune Operations
Audited by: codex
Jan 17, 2026, 09:03 AM
Documentation-only skill containing markdown guides and YAML examples for GitOps workflows. Static analyzer flagged markdown code blocks and Lua syntax as security patterns - all are false positives. No executable code, no network calls, no file system access, no external data processing. Safe for marketplace publication.
4
Files scanned
754
Lines analyzed
2
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (72)
references/argocd-setup.md:6-9 references/argocd-setup.md:9-12 references/argocd-setup.md:12-14 references/argocd-setup.md:14-17 references/argocd-setup.md:17-20 references/argocd-setup.md:20-25 references/argocd-setup.md:25-31 references/argocd-setup.md:31-34 references/argocd-setup.md:34-61 references/argocd-setup.md:61-66 references/argocd-setup.md:66-68 references/argocd-setup.md:68-71 references/argocd-setup.md:71-73 references/argocd-setup.md:73-76 references/argocd-setup.md:76-82 references/argocd-setup.md:82-87 references/argocd-setup.md:87-105 references/argocd-setup.md:105-108 references/argocd-setup.md:108-121 references/sync-policies.md:6-12 references/sync-policies.md:12-15 references/sync-policies.md:15-20 references/sync-policies.md:20-23 references/sync-policies.md:23-35 references/sync-policies.md:35-38 references/sync-policies.md:38-46 references/sync-policies.md:46-51 references/sync-policies.md:51-63 references/sync-policies.md:63-66 references/sync-policies.md:66-74 references/sync-policies.md:74-79 references/sync-policies.md:79-108 references/sync-policies.md:108-113 references/sync-policies.md:113-114 references/sync-policies.md:114-115 references/sync-policies.md:115-116 references/sync-policies.md:116-117 references/sync-policies.md:117-118 SKILL.md:34-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-65 SKILL.md:65-69 SKILL.md:69-91 SKILL.md:91-95 SKILL.md:95-112 SKILL.md:112-118 SKILL.md:118-129 SKILL.md:129-133 SKILL.md:133-144 SKILL.md:144-148 SKILL.md:148-161 SKILL.md:161-168 SKILL.md:168-180 SKILL.md:180-183 SKILL.md:183-189 SKILL.md:189-191 SKILL.md:191-197 SKILL.md:197-212 SKILL.md:212-216 SKILL.md:216-222 SKILL.md:222-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-253 SKILL.md:253-271 SKILL.md:271-274 SKILL.md:274-277 SKILL.md:277-280 SKILL.md:280-284 SKILL.md:284-285 SKILL.md:120
🌐 Network access (14)
Audited by: claude
Jan 17, 2026, 09:03 AM
Documentation-only skill containing markdown guides and YAML examples for GitOps workflows. Static analyzer flagged markdown code blocks and Lua syntax as security patterns - all are false positives. No executable code, no network calls, no file system access, no external data processing. Safe for marketplace publication.
4
Files scanned
754
Lines analyzed
2
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (72)
references/argocd-setup.md:6-9 references/argocd-setup.md:9-12 references/argocd-setup.md:12-14 references/argocd-setup.md:14-17 references/argocd-setup.md:17-20 references/argocd-setup.md:20-25 references/argocd-setup.md:25-31 references/argocd-setup.md:31-34 references/argocd-setup.md:34-61 references/argocd-setup.md:61-66 references/argocd-setup.md:66-68 references/argocd-setup.md:68-71 references/argocd-setup.md:71-73 references/argocd-setup.md:73-76 references/argocd-setup.md:76-82 references/argocd-setup.md:82-87 references/argocd-setup.md:87-105 references/argocd-setup.md:105-108 references/argocd-setup.md:108-121 references/sync-policies.md:6-12 references/sync-policies.md:12-15 references/sync-policies.md:15-20 references/sync-policies.md:20-23 references/sync-policies.md:23-35 references/sync-policies.md:35-38 references/sync-policies.md:38-46 references/sync-policies.md:46-51 references/sync-policies.md:51-63 references/sync-policies.md:63-66 references/sync-policies.md:66-74 references/sync-policies.md:74-79 references/sync-policies.md:79-108 references/sync-policies.md:108-113 references/sync-policies.md:113-114 references/sync-policies.md:114-115 references/sync-policies.md:115-116 references/sync-policies.md:116-117 references/sync-policies.md:117-118 SKILL.md:34-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-65 SKILL.md:65-69 SKILL.md:69-91 SKILL.md:91-95 SKILL.md:95-112 SKILL.md:112-118 SKILL.md:118-129 SKILL.md:129-133 SKILL.md:133-144 SKILL.md:144-148 SKILL.md:148-161 SKILL.md:161-168 SKILL.md:168-180 SKILL.md:180-183 SKILL.md:183-189 SKILL.md:189-191 SKILL.md:191-197 SKILL.md:197-212 SKILL.md:212-216 SKILL.md:216-222 SKILL.md:222-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-253 SKILL.md:253-271 SKILL.md:271-274 SKILL.md:274-277 SKILL.md:277-280 SKILL.md:280-284 SKILL.md:284-285 SKILL.md:120
🌐 Network access (14)
Audited by: claude
Jan 4, 2026, 04:25 PM
Documentation-only skill with no executable code. Contains only static guides, YAML examples, and best practices for GitOps workflows. No security risks identified.
6
Files scanned
816
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 4, 2026, 04:25 PM
Documentation-only skill with no executable code. Contains only static guides, YAML examples, and best practices for GitOps workflows. No security risks identified.
6
Files scanned
816
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude