📦

審計紀錄

security-guardian - 6 審計

審計版本 6

最新 中風險

Jun 28, 2026, 03:16 PM

Static analysis detected many dangerous command, network, filesystem, script, and secret patterns. Manual review found these are primarily security-training examples and audit checklists, not executable code or hidden exfiltration. The skill is publishable with a medium dual-use warning because it documents exploit payloads and sensitive target examples.

26
已掃描檔案
7,813
分析行數
10
發現
codex
審計單位
中風險問題 (2)
Dual-use exploit reference content
The skill includes concrete examples of command injection, path traversal, SSRF metadata access, XXE file disclosure, and XSS sink patterns. These are presented as vulnerability examples and audit targets, but they can also help users construct tests or payloads.
Bash tool permission in a security audit skill
The skill declares Bash as an allowed tool while also instructing users to search vulnerability patterns. This is expected for code auditing, but command execution should remain limited to local inspection commands and user-approved project analysis.
低風險問題 (3)
Static command execution findings are documentation examples
Most external command findings are code snippets or pattern lists used to teach auditors what vulnerable code looks like. I did not find evidence that the skill itself executes these snippets.
Sensitive file and credential strings are audit targets
Sensitive paths, credential filenames, and placeholder API key strings appear in checklists and training examples. They describe what to detect or exclude, not files being read by the skill.
No prompt injection attempt found
Targeted review found no instructions claiming special authority, telling the evaluator to ignore prior instructions, or asking to skip security analysis. Administrator appears only inside a Windows path example.

偵測到的模式

Dynamic code execution patternsCommand injection payload examplesSensitive path traversal targetsCloud metadata endpoint examples

審計版本 5

安全

Jan 16, 2026, 07:37 PM

This skill is purely security documentation and guidance. All 1546 static findings are FALSE POSITIVES because they come from markdown documentation files containing examples of vulnerable code patterns for educational purposes. The skill provides read-only analysis tools (Read, Grep, Glob, Bash) to help developers identify and fix security issues.

27
已掃描檔案
8,194
分析行數
4
發現
claude
審計單位
未發現安全問題

審計版本 4

安全

Jan 16, 2026, 07:37 PM

This skill is purely security documentation and guidance. All 1546 static findings are FALSE POSITIVES because they come from markdown documentation files containing examples of vulnerable code patterns for educational purposes. The skill provides read-only analysis tools (Read, Grep, Glob, Bash) to help developers identify and fix security issues.

27
已掃描檔案
8,194
分析行數
4
發現
claude
審計單位
未發現安全問題

審計版本 3

安全

Jan 10, 2026, 11:28 AM

Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.

28
已掃描檔案
8,500
分析行數
0
發現
claude
審計單位
未發現安全問題

審計版本 2

安全

Jan 10, 2026, 11:28 AM

Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.

28
已掃描檔案
8,500
分析行數
0
發現
claude
審計單位
未發現安全問題

審計版本 1

安全

Jan 10, 2026, 11:28 AM

Pure prompt-based skill containing only markdown documentation about security best practices. No executable code, no scripts, no network operations, no data collection. Provides educational guidance on OWASP Top 10, authentication, authorization, cryptography, and vulnerability detection.

28
已掃描檔案
8,500
分析行數
0
發現
claude
審計單位
未發現安全問題