Versioned security assessment

Report ID: SA-88A205C7

7/8/2026, 4:02:43 PM

systematic-debugging security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
systematic-debugging
Version
v4
Maintainer
ZhanlinCui
Source
github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/systematic-debugging
Coverage
11 Files scanned · 1,262 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

I reviewed the static findings in context. The Ruby backtick, reconnaissance, environment-file, and device-file hits are false positives from Markdown fences, TypeScript template literals, safe NODE_ENV checks, and a manual test helper. One medium semantic issue remains because a debugging example can encourage logging environment and keychain state without redaction.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

11 Files scanned · 1,262 Lines analyzed

1 item shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 20 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:90-105
Diagnostic Logging May Expose Sensitive CI Context
The debugging example tells users to inspect environment variables matching IDENTITY and keychain identity state. If copied into CI logs without redaction, this can expose signing or deployment metadata.
The commands are documentation examples and not auto-run, but the example explicitly logs environment and keychain state during signing diagnostics.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Diagnostic example can leak environment or signing metadata.
    Change the example to log only SET or UNSET states, remove broad env output, and warn users to redact CI logs.
  2. FIX-002
    Low
    Helper script executes project tests for every matched file.
    Mark find-polluter.sh as manual-only, require users to inspect the pattern, and document that it runs repository test code.
  3. FIX-003
    Low
    Executable helpers and documentation examples are mixed in the same skill package.
    Label examples as non-install hooks and keep helper scripts documented with expected inputs and effects.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
88a205c7f635a966e31156313b590d59007c5caa
Content hash
4999cb851360485eca5074e727bbdd62ef20549c5d5b01216fcbf5831badb473
Tree hash
a21581dae61ffd8923bcde0bb233f43586575733bbf8280c47da70cfaf7cff5a
Skill path
skills/zhanlincui/systematic-debugging
Audit payload hash
76e0cd5d93d1deb89b54df24e2130b81

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable