📦

Audit History

hybrid-search-implementation - 8 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v8 LatestJul 7, 2026, 07:28 AM 1 confirmed0No capability change
v7 Jul 7, 2026, 07:28 AM 1 confirmed0External commands
v6 Jul 1, 2026, 01:11 AM 1 confirmed1Network access Contains scriptsFilesystem access
v5 Jan 21, 2026, 07:22 PM No confirmed findings0Contains scriptsFilesystem access Network accessExternal commands
v4 Jan 17, 2026, 09:23 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 09:23 AM No confirmed findings0External commands
v2 Jan 4, 2026, 04:30 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 04:30 PM No confirmed findings0Baseline

Jul 7, 2026, 07:28 AM

Most static findings are false positives from Markdown code fences, search variable names, and documentation links. No prompt injection, credential access, or malicious execution intent was found. One semantic issue remains in the PostgreSQL metadata filter example, which can permit SQL injection if filter names are untrusted.

1
Files scanned
569
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SQL Injection Risk in Metadata Filters
The PostgreSQL template appends filter_metadata keys into a SQL predicate with string interpolation. If callers pass untrusted filter names, they can alter the SQL predicate despite parameterized values.
The value side is parameterized, but the metadata key is concatenated into where_clause and then inserted into the query. This is a clear injection path if filter names are user controlled.
Audited by: codex

Jul 7, 2026, 07:28 AM

Most static findings are false positives from Markdown code fences, search variable names, and documentation links. No prompt injection, credential access, or malicious execution intent was found. One semantic issue remains in the PostgreSQL metadata filter example, which can permit SQL injection if filter names are untrusted.

1
Files scanned
569
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SQL Injection Risk in Metadata Filters
The PostgreSQL template appends filter_metadata keys into a SQL predicate with string interpolation. If callers pass untrusted filter names, they can alter the SQL predicate despite parameterized values.
The value side is parameterized, but the metadata key is concatenated into where_clause and then inserted into the query. This is a clear injection path if filter names are user controlled.
Audited by: codex

Jul 1, 2026, 01:11 AM

Most static findings are false positives caused by Markdown code fences, search terminology, and resource links. The audit found a real SQL injection risk in the PostgreSQL template, where metadata keys are interpolated into SQL, so publication should wait for a safer example.

1
Files scanned
569
Lines analyzed
3
Review items
3
False positives ignored

Confirmed security concerns (1)

High
SQL Injection Risk in PostgreSQL Filter Template
The PostgreSQL example appends filter metadata keys into a SQL WHERE clause and then interpolates that clause into conn.fetch. Values are parameterized, but keys are not validated or quoted, so untrusted filter names could alter the generated SQL.
The relevant code directly inserts metadata key names into SQL text before executing the query. This is a classic identifier injection issue, even though filter values use parameters.
Needs review findings (1)

These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.

Medium
Potential Elasticsearch Script Injection in Example Query
The Elasticsearch example inserts boost_vector into a script_score source string instead of passing it as a script parameter. The type hint says float, but copied code may receive untrusted runtime input.
The pattern is present in copyable code, but the parameter is annotated as a float and may be controlled only by trusted application code.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Markdown Fences Misclassified as Shell Execution
The external command findings point to Markdown code fences and Python examples, not Ruby backtick shell execution. No executable shell command behavior is present in those locations.
The line-numbered evidence shows Markdown fences and section transitions. I did not find Ruby backtick execution at these locations.
Low
Credential and Weak Crypto Findings Are Vocabulary Matches
The sensitive, weak cryptography, and reconnaissance findings match words such as keyword, embedding, method, code, and index in search documentation. No certificates, private keys, hash routines, or system probing commands are shown.
The cited lines contain ordinary hybrid search terms and result ranking code. I did not find credential access, cryptographic operations, or host reconnaissance.
Low
Resource Links and Database Fetch Are Not Exfiltration
The network findings include a database fetch call inside an example and public documentation links. They do not send credentials or local data to an unauthorized endpoint.
The fetch call is asyncpg database access and the URLs are resource citations. I did not find evidence of credential exfiltration.

Risk Factors

Detected Patterns

Unvalidated Identifier Interpolation in SQLInline Script Construction for Elasticsearch Scoring
Audited by: codex

Jan 21, 2026, 07:22 PM

All static findings are false positives. The skill contains documentation templates for hybrid search algorithms (RRF, linear fusion) with PostgreSQL, Elasticsearch, and custom RAG pipelines. Static scanner misidentified mathematical formulas as crypto operations, markdown code fences as command execution, and benign terminology as security risks. No malicious code or credential exfiltration present.

2
Files scanned
1,169
Lines analyzed
2
Review items
0
False positives ignored

Risk Factors

⚡ Contains scripts (1)
📁 Filesystem access (1)
Audited by: claude

Jan 17, 2026, 09:23 AM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2
Files scanned
764
Lines analyzed
2
Review items
0
False positives ignored

Detected Patterns

Hardcoded URLWeak cryptographic algorithmSystem reconnaissanceRuby/shell backtick executionFetch API callCertificate/key files[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: claude

Jan 17, 2026, 09:23 AM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2
Files scanned
764
Lines analyzed
2
Review items
0
False positives ignored

Detected Patterns

Hardcoded URLWeak cryptographic algorithmSystem reconnaissanceRuby/shell backtick executionFetch API callCertificate/key files[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: claude

Jan 4, 2026, 04:30 PM

Documentation-only skill with Python templates for hybrid search. Templates show database connections (PostgreSQL, Elasticsearch) which implies network access in user implementations. No credential access, file system writes, or command execution. Risk is limited to standard template patterns.

4
Files scanned
807
Lines analyzed
1
Review items
0
False positives ignored

Risk Factors

Audited by: claude

Jan 4, 2026, 04:30 PM

Documentation-only skill with Python templates for hybrid search. Templates show database connections (PostgreSQL, Elasticsearch) which implies network access in user implementations. No credential access, file system writes, or command execution. Risk is limited to standard template patterns.

4
Files scanned
807
Lines analyzed
1
Review items
0
False positives ignored

Risk Factors

Audited by: claude