Skills search-engineer Audit History
📦

Audit History

search-engineer - 4 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v4 LatestJul 24, 2026, 12:00 AM No confirmed findings1No capability change
v3 Jul 15, 2026, 03:38 PM No confirmed findings1No capability change
v2 Jul 15, 2026, 03:38 PM No confirmed findings1No capability change
v1 Jul 15, 2026, 03:38 PM No confirmed findings1Baseline

Jul 24, 2026, 12:00 AM

The 25 external-command findings are false positives caused by Markdown code fences; the document does not use Ruby or shell backtick execution. The pinned third-party plugin installation is a genuine low-severity network and supply-chain risk because no checksum or signature verification is provided.

1
Files scanned
310
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Hardcoded URL
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/downl
Line 88 directs the plugin installer to download a third-party release archive from GitHub. The version is pinned, but the example provides no checksum or signature verification.
Audited by: codex

Jul 15, 2026, 03:38 PM

All 25 external-command findings are false positives caused by Markdown code fences, not Ruby or shell backtick execution. The remote plugin installation URL is a legitimate example, but installing an unchecked archive creates a low-severity supply-chain risk.

1
Files scanned
310
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Hardcoded URL
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/downl
Line 88 instructs Elasticsearch to download and install a remote plugin archive without checksum verification. The trusted GitHub release context limits impact, but artifact replacement could compromise the host.
Audited by: codex

Jul 15, 2026, 03:38 PM

All 25 external-command findings are false positives caused by Markdown code fences, not Ruby or shell backtick execution. The remote plugin installation URL is a legitimate example, but installing an unchecked archive creates a low-severity supply-chain risk.

1
Files scanned
310
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Hardcoded URL
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/downl
Line 88 instructs Elasticsearch to download and install a remote plugin archive without checksum verification. The trusted GitHub release context limits impact, but artifact replacement could compromise the host.
Audited by: codex

Jul 15, 2026, 03:38 PM

All 25 external-command findings are false positives caused by Markdown code fences, not Ruby or shell backtick execution. The remote plugin installation URL is a legitimate example, but installing an unchecked archive creates a low-severity supply-chain risk.

1
Files scanned
310
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Hardcoded URL
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/downl
Line 88 instructs Elasticsearch to download and install a remote plugin archive without checksum verification. The trusted GitHub release context limits impact, but artifact replacement could compromise the host.
Audited by: codex