This report does not block or authorize the manifest or ZIP.
Static analysis produced many hits, but most markdown backtick, weak-crypto, path traversal, reconnaissance, and obfuscation findings are false positives after contextual review. The confirmed risk is that the helper can execute README-derived commands from an untrusted target repository when explicitly enabled, which is legitimate for this skill but requires a marketplace warning and user review.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
13 Files scanned · 1,398 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The orchestration script can execute a command extracted from the target repository README when --run-selected is enabled. This is expected for a reproduction skill, but a malicious or untrusted repository README could cause arbitrary local command execution in the target repo context.
subprocess.run executes shlex-split README-derived command strings with cwd set to the target repository. The behavior is gated by --run-selected and fits the skill purpose, so the risk is real but contextual.
For selected training targets, the script forwards the README-derived training command to a separate run-train script. The reviewed file does not show the runner implementation, so the main concern is delegated execution of untrusted repository commands under the reproduction workflow.
The command is clearly passed to another script with repo path, timeout, and training mode. The actual execution details are outside this file, so the confidence is high for delegated execution but lower for exact impact.
The skill asks the agent to load reference files through ../../ paths. This appears to be shared documentation loading, not data exfiltration, but it expands the review boundary beyond the skill directory and should be checked during packaging.
The referenced paths are explicit read-only documentation paths. They are not direct traversal exploits, but they can cause the skill to depend on files outside its package.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
The script writes a temporary JSON context file before invoking the bundle writer and removes it in a finally block. This is a normal implementation pattern with limited residual risk if process termination prevents cleanup.
The temporary file contains generated context and is deleted in a finally block. No evidence shows secret collection or intentional persistence.
Static Scanner Markdown And Weak-Crypto False Positives
Many static hits are markdown code fences, template placeholders, filenames, or ordinary prose such as Rigor Reproduce. No evidence found of weak cryptographic algorithms, Ruby backtick execution, JS obfuscation, or prompt injection in the reviewed files.
The cited files contain documentation, YAML prompt text, code fences, placeholders, and a shebang. Targeted review found no crypto implementation, Ruby execution, obfuscation payload, or injection text.