📦

Audit History

monorepo-management - 8 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v8 LatestJul 8, 2026, 12:30 PM No confirmed findings0No capability change
v7 Jul 8, 2026, 12:30 PM No confirmed findings0No capability change
v6 Jul 1, 2026, 12:51 AM No confirmed findings3No capability change
v5 Jul 1, 2026, 12:51 AM No confirmed findings3No capability change
v4 Jan 17, 2026, 08:29 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 08:29 AM No confirmed findings0Network accessExternal commandsFilesystem accessEnv variables
v2 Jan 4, 2026, 04:43 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 04:43 PM No confirmed findings0Baseline

Jul 1, 2026, 12:51 AM

Static analysis flagged command execution, hidden file access, token references, a hardcoded URL, and heuristic combinations. Review found SKILL.md is documentation with fenced examples for Turborepo, Nx, pnpm, CI, and releases; no prompt injection, obfuscated code, secret exfiltration, or executable skill scripts were found. Low risk remains because users may copy commands that install packages, remove node_modules, deploy, or publish packages.

1
Files scanned
623
Lines analyzed
7
Review items
1
False positives ignored
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Package and Shell Commands Are Documentation Examples
The repeated external command matches occur inside fenced examples for creating workspaces, running pnpm and nx tasks, CI jobs, deployment, and publishing. This is not active code execution by the skill, but copied commands can modify repositories, install packages, deploy apps, or publish packages.
The line ranges are fenced documentation snippets, not executable files or skill scripts. The commands are legitimate monorepo operations, but they have real effects if a user copies them into a shell.
Low
Hidden File and Environment File References Are Configuration Examples
The hidden file findings point to sample configuration paths such as .env patterns, .npmrc, .eslintrc.js, and .github workflows. No evidence found that the skill reads, writes, or exfiltrates these files.
The references are visible file names in configuration examples. There is no code path that opens local hidden files or collects environment file contents.
Low
CI Secret Names Appear in a Release Workflow Example
GITHUB_TOKEN and NPM_TOKEN are shown as GitHub Actions secret names for a package release example. This is normal CI documentation and does not send secrets to an untrusted endpoint in the skill content.
The token names appear only inside a release workflow snippet using changesets/action. The context supports legitimate publishing, though users should keep token scopes minimal.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Heuristic Combination Dismissed After Context Review
The critical combination of command, network, filesystem, and credential signals is caused by unrelated documentation examples. The hardcoded URL is a schema reference, line 3 does not contain cryptography, and the dependency graph text is not system reconnaissance.
Manual review confirmed these static matches are documentation artifacts rather than a coherent malicious behavior chain. No prompt injection language or hidden execution mechanism was found.
Audited by: codex

Jul 1, 2026, 12:51 AM

Static analysis flagged command execution, hidden file access, token references, a hardcoded URL, and heuristic combinations. Review found SKILL.md is documentation with fenced examples for Turborepo, Nx, pnpm, CI, and releases; no prompt injection, obfuscated code, secret exfiltration, or executable skill scripts were found. Low risk remains because users may copy commands that install packages, remove node_modules, deploy, or publish packages.

1
Files scanned
623
Lines analyzed
7
Review items
1
False positives ignored
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Package and Shell Commands Are Documentation Examples
The repeated external command matches occur inside fenced examples for creating workspaces, running pnpm and nx tasks, CI jobs, deployment, and publishing. This is not active code execution by the skill, but copied commands can modify repositories, install packages, deploy apps, or publish packages.
The line ranges are fenced documentation snippets, not executable files or skill scripts. The commands are legitimate monorepo operations, but they have real effects if a user copies them into a shell.
Low
Hidden File and Environment File References Are Configuration Examples
The hidden file findings point to sample configuration paths such as .env patterns, .npmrc, .eslintrc.js, and .github workflows. No evidence found that the skill reads, writes, or exfiltrates these files.
The references are visible file names in configuration examples. There is no code path that opens local hidden files or collects environment file contents.
Low
CI Secret Names Appear in a Release Workflow Example
GITHUB_TOKEN and NPM_TOKEN are shown as GitHub Actions secret names for a package release example. This is normal CI documentation and does not send secrets to an untrusted endpoint in the skill content.
The token names appear only inside a release workflow snippet using changesets/action. The context supports legitimate publishing, though users should keep token scopes minimal.
Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Heuristic Combination Dismissed After Context Review
The critical combination of command, network, filesystem, and credential signals is caused by unrelated documentation examples. The hardcoded URL is a schema reference, line 3 does not contain cryptography, and the dependency graph text is not system reconnaissance.
Manual review confirmed these static matches are documentation artifacts rather than a coherent malicious behavior chain. No prompt injection language or hidden execution mechanism was found.
Audited by: codex

Jan 4, 2026, 04:43 PM

All files contain only instructional text with example commands and configurations. No executable scripts, network calls, filesystem access, or environment access are present. This is purely educational content.

4
Files scanned
827
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 4, 2026, 04:43 PM

All files contain only instructional text with example commands and configurations. No executable scripts, network calls, filesystem access, or environment access are present. This is purely educational content.

4
Files scanned
827
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude