Audit History
specdd-trace - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
2026年7月7日 上午05:38
All seven static external-command findings are false positives caused by Markdown inline code references, not executable shell or Ruby backticks. The skill guides agents through SpecDD traceability work and does not request command execution, network access, secret access, or prompt override behavior.
Risk Factors
⚙️ External commands (7)
2026年7月7日 上午05:38
All seven static external-command findings are false positives caused by Markdown inline code references, not executable shell or Ruby backticks. The skill guides agents through SpecDD traceability work and does not request command execution, network access, secret access, or prompt override behavior.
Risk Factors
⚙️ External commands (7)
2026年6月30日 下午08:01
Static analysis reported external command execution and weak cryptography indicators, but review found no executable code or cryptographic use. The backtick hits are Markdown references to SpecDD files and a skill name, and the line 3 crypto hit is only descriptive text.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
2026年6月12日 上午11:57
Static analysis flagged 9 patterns, all determined to be false positives after review. The 8 'Ruby/shell backtick execution' findings are inline code references in Markdown documentation (e.g., `.specdd/bootstrap.md`) — standard Markdown backtick formatting, not executable code. The 1 'weak cryptographic algorithm' finding at line 3 is the YAML frontmatter description field and contains no cryptographic code. The skill is a 65-line Markdown instruction file with no executable code, no network access, and no data exfiltration patterns.