Why this verdict
- benign: 25 checks satisfied, no findings for skill:replica-backend
Security findings 0
No security findings
No suspicious or malicious behavior was found; 2 candidate findings were refuted on review.
Open questions 1
What the analysis could not settle from the code alone.
[file request replica/architecture.md] The skill body instructs the agent to read replica/architecture.md as build input; does the shipped file contain directives aimed at the agent that go beyond architecture data?
Agent hijacking
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Agent hijacking
highRefutedlow confidenceThe skill instructs the agent to ingest replica/architecture.md as authoritative build input although the file is not shipped as consumed content, so the agent will apply whatever directives exist at that path at runtime.
Reads `replica/architecture.md`.
Why it was refuted
Ingesting the project's architecture spec is the skill's declared core workflow, not a hijack vector: the artifact itself declares that migrations come from architecture.md, the residue extraction flags only .env.local/.env.example (not architecture.md), and no directive-bearing content or sink is shown.
Credential access
highRefutedlow confidenceThe skill's workflow places the user's real Stripe/Supabase/Resend/Google Cloud API keys into the workspace file `.env.local`, and a detector flags an undeclared file-read of that credential file, establishing a credential source whose downstream use (any network sink) is not shown in these units.
puts keys in `.env.local`
Why it was refuted
The workflow keeps key creation and placement with the user, bars the agent from live keys, and mandates test mode, making .env.local the env-key mechanism for the declared Stripe/Supabase/Resend/Google integrations (declared core capability carve-out); the shown units establish no downstream sink, so no source-to-sink chain exists.
