This report does not block or authorize the manifest or ZIP.
Static findings are mostly true detections of shell, CI, cloud, network, and secret-handling examples inside SKILL.md, but I found no executable skill code or confirmed malicious exfiltration. The main risk is that users may copy examples that echo secrets, rely on long-lived cloud credentials, or use dummy secrets in unsafe ways.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 365 Lines analyzed
4 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The GitHub Actions and GitLab examples print API keys or database URLs. This is a true positive for risky secret handling because copied examples could expose credentials in job logs.
The examples directly echo secret variables. They are documentation snippets, not active code, so the risk depends on users copying them.
The GitHub Actions example uses AWS access key and secret access key values from repository secrets. This is functional, but OIDC federation is safer for CI/CD access to AWS.
The snippet clearly configures static AWS credentials in CI. It may be legitimate, but it raises avoidable credential lifetime and storage risk.
Several examples include root tokens, simple passwords, and placeholder production names. These are likely instructional placeholders, but they need stronger warnings and non-sensitive placeholders.
The values appear in documentation examples and are not evidence of real leaked credentials. They still create a user safety issue if copied into production.
Critical Combined-Heuristic Finding Is Not Confirmed
The combined code execution, network, and credential heuristic is explained by documentation examples for a secrets-management skill. I found no active script, prompt injection, or malicious data flow.
The risk factors co-occur in Markdown snippets that teach secret tooling. The absence of executable skill files lowers confidence in malicious intent.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Hardcoded URLs And Local IP Are Documentation Examples
The hardcoded Vault URLs and localhost address are true pattern matches, but they are example endpoints in Markdown. I found no evidence that the skill sends data to those endpoints.
The lines are static configuration examples inside SKILL.md. No executable file or exfiltration destination was found.