This report does not block or authorize the manifest or ZIP.
Static analysis flagged many patterns, but review found no confirmed malicious intent or prompt-injection attempt. The confirmed risks are expected for this skill: local scripts, third-party network requests, file writes, environment access, and persistence of user API tokens into Claude settings. Publish with a warning about credential storage, third-party provider cost, and local script execution.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
24 Files scanned · 2,969 Lines analyzed
4 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Long-Lived Credential Persistence In Claude Settings
The skill instructs the assistant and setup script to persist APIFY_API_TOKEN and optional Reddit credentials into the env block of ~/.claude/settings.json. This is a legitimate BYOK design, but it creates long-lived secrets on disk that scheduled and future sessions inherit, so users need clear consent and rotation guidance.
Multiple runtime instructions and setup code describe writing provider tokens into a home-directory Claude settings file. The behavior is intentional and documented, but it is still sensitive credential handling.
The adapters call Apify, Reddit OAuth, LinkedIn actor, and optional X actor endpoints using user-provided tokens and configured topics, profiles, and subreddits. This is core functionality, not hidden exfiltration, but it exposes search intent and may incur third-party cost or provider-side logging.
Direct HTTP requests to named third-party APIs are present in the adapter scripts. The surrounding skill documentation matches this purpose, so the network behavior is confirmed but expected.
The setup script runs git, pip, Python, and shell command substitutions, while the skill workflow instructs users to run multiple local Python scripts. Most markdown backtick detections are documentation examples, but the installer and adapters are executable code and should be reviewed before use.
The setup file contains real shell commands and embedded Python. Static hits in markdown are noisy, but the core command-execution risk is real for installation and routine operation.
Local File Writes For Config, Outputs, And History
The skill writes user config, raw signal files, ranked outputs, digests, and watchlist history. These writes are expected for the workflow, but the data can contain social profile targets, posts, draft comments, and credentials when settings persistence is used.
The referenced files contain direct write operations or explicit instructions to write persistent configuration. The writes are bounded to local workflow artifacts, so the concern is privacy and data handling rather than destructive behavior.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static Scanner False Positives For Weak Crypto, SAM, And Prompt Injection
The weak-cryptography and Windows SAM detections are string matches in descriptions, schema text, or ordinary code comments, not evidence of cryptographic decisions or credential-database access. A targeted search found no prompt-injection language such as instructions to ignore prior rules or claim pre-approval.
The cited files were inspected around representative hits and did not show weak crypto use, SAM access, or malicious instruction text. Confidence is not maximal because the static list is large, but sampled high-severity alerts were explainable as context matches.