Audit History
deploying-to-production - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 8, 2026, 12:35 PM | No confirmed findings | 0 | No capability change |
| v3 | Jul 8, 2026, 12:35 PM | No confirmed findings | 0 | No capability change |
| v2 | Jul 1, 2026, 03:23 AM | 1 confirmed | 0 | No capability change |
| v1 | Feb 24, 2026, 09:35 AM | No confirmed findings | 0 | Baseline |
Jul 8, 2026, 12:35 PM
The single static finding is a false positive caused by an inline Markdown build command. No prompt injection, credential exfiltration, or hidden malicious deployment intent was found in SKILL.md.
Risk Factors
⚙️ External commands (1)
Jul 8, 2026, 12:35 PM
The single static finding is a false positive caused by an inline Markdown build command. No prompt injection, credential exfiltration, or hidden malicious deployment intent was found in SKILL.md.
Risk Factors
⚙️ External commands (1)
Jul 1, 2026, 03:23 AM
Static analysis flagged one external command and one weak cryptography pattern. The cryptography finding is a false positive because SKILL.md line 3 is frontmatter description text, while the build command on line 22 is expected deployment behavior with ordinary script execution risk.
Confirmed security concerns (1)
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (1)
Detected Patterns
Feb 24, 2026, 09:35 AM
Both static findings are false positives. The 'external_commands' detection refers to a standard 'npm run build' command which is a legitimate build step in web deployment workflows. The 'weak cryptographic algorithm' flag was triggered by YAML frontmatter text that contains no cryptographic code. This skill provides safe, read-only deployment guidance.