This report does not block or authorize the manifest or ZIP.
Most backtick findings are false positives from Markdown text and code-fence parsing, not shell execution. The helper does read OpenAI-compatible credentials and can send supplied data context to an external LLM endpoint, while returning generated Python code that needs sandbox enforcement.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
3 Files scanned · 120 Lines analyzed
11 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The line directly obtains an API key from role_config or OPENAI_API_KEY. That is real credential handling in skill code and must be treated as a high-impact secret exposure surface.
The fallback reads settings.OPENAI_API_KEY when no config or environment key is present. This is another direct API credential access path in community skill code.
The API key is passed into AsyncOpenAI along with a configurable base_url. This is intended authentication, but it confirms the secret is used for outbound OpenAI-compatible requests.
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The code reads OPENAI_API_KEY from the environment as a credential source. Environment secret access is security-relevant in a community skill, even when used for authentication.
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
The code reads OPENAI_BASE_URL from the environment, which controls the API destination. This is legitimate configuration, but it affects where requests and credentials may be sent.
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
This is a duplicate detector hit for the OPENAI_BASE_URL environment read. The destination setting is security-relevant because it influences outbound API routing.
api_key = role_config.get("api_key") or os.getenv("OPENAI_API_KEY")
The line can read an api_key value from role_config before falling back to the environment. Config-sourced API credentials are sensitive and need disclosure and handling controls.
base_url = role_config.get("base_url") or os.getenv("OPENAI_BASE_URL")
The line can read base_url from role_config before falling back to the environment. This setting controls the OpenAI-compatible endpoint used by the helper.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
generate_analysis_code sends the provided data context and requirement to an OpenAI-compatible chat completions endpoint. Sensitive dataset details may leave the sandbox through the configured base_url.
The user_prompt includes data_context and requirement, and the next call sends those messages through client.chat.completions.create. This is a direct external service transmission path.
The helper asks the model for a complete runnable Python script and returns extracted code without validation. The file does not show enforcement of sandbox limits before generated code is handed back.
The prompt explicitly requests runnable code, and the response parser returns the code string after fence extraction. There is no validation or policy check visible in this file.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
High
OpenAI-compatible credentials are read from config, environment variables, and application settings.
Document all credential access, avoid broad environment reads, and pass scoped credentials from a trusted host integration only.
FIX-002
Medium
Data context and requirements are sent to an external LLM endpoint.
Add user-facing disclosure, redact sensitive fields before requests, and restrict base_url to approved endpoints when possible.
FIX-003
Medium
Generated Python code is returned without validation in this helper.
Add static checks for generated code and require execution inside a locked sandbox with no unapproved network or filesystem access.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.