📦

Audit History

postmortem-writing - 8 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v8 LatestJul 8, 2026, 01:11 PM No confirmed findings0No capability change
v7 Jul 8, 2026, 01:11 PM No confirmed findings0External commands
v6 Jul 1, 2026, 12:10 AM No confirmed findings1No capability change
v5 Jul 1, 2026, 12:10 AM No confirmed findings1 External commands
v4 Jan 17, 2026, 09:13 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 09:13 AM No confirmed findings0Network accessExternal commands
v2 Jan 5, 2026, 05:06 PM No confirmed findings0No capability change
v1 Jan 5, 2026, 05:06 PM No confirmed findings0Baseline

Jul 8, 2026, 01:11 PM

All static findings are false positives caused by Markdown fences, inline code formatting, sample incident analysis text, and passive reference links. No prompt injection, command execution, active network behavior, or data exfiltration intent was found in SKILL.md.

1
Files scanned
375
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 8, 2026, 01:11 PM

All static findings are false positives caused by Markdown fences, inline code formatting, sample incident analysis text, and passive reference links. No prompt injection, command execution, active network behavior, or data exfiltration intent was found in SKILL.md.

1
Files scanned
375
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 1, 2026, 12:10 AM

Static analysis reported many high-risk patterns, but review found they occur inside Markdown examples, prose, and incident templates rather than executable code. The only confirmed risk factor is low-risk network exposure from three external reference links; no prompt injection, malicious intent, credential access, or runnable command execution was found.

1
Files scanned
375
Lines analyzed
2
Review items
3
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
External Documentation Links
The skill links to Google SRE, Etsy, and PagerDuty postmortem resources. These are user-visible references, not hidden network requests or data exfiltration paths.
The URLs are explicit Markdown resource links at the end of the guide. There is no code that fetches them or sends user data to them.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Command-Execution Findings Are Markdown False Positives
The reported Ruby and shell backtick locations are fenced Markdown examples, inline code formatting, diagrams, and templates. SKILL.md contains guidance text only and no executable script blocks that run commands.
The reviewed locations are prose or Markdown template content. The file contains no Ruby, shell, JavaScript, or Python execution logic around these lines.
Low
Static Blocker Findings Are Prose False Positives
The weak cryptography, at scheduling, and system reconnaissance findings are triggered by ordinary incident-response wording and template content. No cryptographic operation, task scheduling command, or host reconnaissance command is present.
The cited lines are YAML metadata, postmortem analysis prompts, or best-practice prose. I found no executable commands or security-sensitive implementation in those contexts.
Low
Network Library Finding Is Textual False Positive
The Python HTTP library finding at line 229 is caused by the word requests in an incident evidence sentence. It does not import a library or perform any HTTP operation.
Line 229 is inside a 5 Whys postmortem example and describes pending requests as operational evidence. There is no Python code or network call at this location.

Risk Factors

Audited by: codex

Jul 1, 2026, 12:10 AM

Static analysis reported many high-risk patterns, but review found they occur inside Markdown examples, prose, and incident templates rather than executable code. The only confirmed risk factor is low-risk network exposure from three external reference links; no prompt injection, malicious intent, credential access, or runnable command execution was found.

1
Files scanned
375
Lines analyzed
2
Review items
3
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
External Documentation Links
The skill links to Google SRE, Etsy, and PagerDuty postmortem resources. These are user-visible references, not hidden network requests or data exfiltration paths.
The URLs are explicit Markdown resource links at the end of the guide. There is no code that fetches them or sends user data to them.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static Command-Execution Findings Are Markdown False Positives
The reported Ruby and shell backtick locations are fenced Markdown examples, inline code formatting, diagrams, and templates. SKILL.md contains guidance text only and no executable script blocks that run commands.
The reviewed locations are prose or Markdown template content. The file contains no Ruby, shell, JavaScript, or Python execution logic around these lines.
Low
Static Blocker Findings Are Prose False Positives
The weak cryptography, at scheduling, and system reconnaissance findings are triggered by ordinary incident-response wording and template content. No cryptographic operation, task scheduling command, or host reconnaissance command is present.
The cited lines are YAML metadata, postmortem analysis prompts, or best-practice prose. I found no executable commands or security-sensitive implementation in those contexts.
Low
Network Library Finding Is Textual False Positive
The Python HTTP library finding at line 229 is caused by the word requests in an incident evidence sentence. It does not import a library or perform any HTTP operation.
Line 229 is inside a 5 Whys postmortem example and describes pending requests as operational evidence. There is no Python code or network call at this location.

Risk Factors

Audited by: codex

Jan 17, 2026, 09:13 AM

This is a documentation-only skill containing markdown guides and templates for writing postmortems. No executable code, file access, network calls, or system capabilities are present. All 46 static findings are false positives - the scanner incorrectly flagged SHA-256 hashes, markdown code fences, timestamps, and documentation phrases as security issues.

2
Files scanned
556
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 17, 2026, 09:13 AM

This is a documentation-only skill containing markdown guides and templates for writing postmortems. No executable code, file access, network calls, or system capabilities are present. All 46 static findings are false positives - the scanner incorrectly flagged SHA-256 hashes, markdown code fences, timestamps, and documentation phrases as security issues.

2
Files scanned
556
Lines analyzed
2
Review items
0
False positives ignored
Audited by: claude

Jan 5, 2026, 05:06 PM

This is a documentation-only skill containing markdown guides and templates for writing postmortems. No executable code, file access, network calls, or system capabilities are present.

4
Files scanned
375
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 5, 2026, 05:06 PM

This is a documentation-only skill containing markdown guides and templates for writing postmortems. No executable code, file access, network calls, or system capabilities are present.

4
Files scanned
375
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude