Why this verdict
- inconclusive: gap request_unanswered
- inconclusive: gap skill_frontmatter_invalid at skills/factory/SKILL.md
- inconclusive: unresolved question on EXFIL
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 1 candidate finding was refuted on review.
Open questions 2
What the analysis could not settle from the code alone.
[invalid file request] Does this MCP helper implementation read credentials or local files, send workspace/secret data to any endpoint beyond the user's own MCP connections, fetch and execute code from a URL, or write to agent/host config for persistence?
Data exfiltration
[file request skills/mcp/mcp.py] The fenced examples invoke an unshown helper module (mcp.list_plugins, mcp.list_connections, mcp.search_tools, mcp.describe_tool, mcp.call_tool). Does its implementation read credentials or local files, send workspace/secret data to any endpoint beyond the user's own MCP connections, fetch and execute code from a URL, or write to agent/host config for persistence?
Data exfiltration
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedmedium confidenceskills/mcp/SKILL.md instructs the agent to execute Python through an mcp helper module (call_tool, list_connections, search_tools, describe_tool) whose implementation is not part of the consumable artifact content, so the runtime behavior of those calls cannot be reviewed.
result = await mcp.call_tool(
Why it was refuted
The instructed calls are the skill's declared core capability: the artifact openly states that every external service is reached through the same pre-imported (host-provided) mcp module, and the target declares calling tools on any connection as the skill's purpose, so executing through this module is the accepted declared-core-capability carve-out. That the module's implementation lives outside the artifact is a declared host dependency (out of scope), not concealed or undeclared behavior; the skill also documents its error, permission, and credential boundaries.
Coverage gaps 5
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
crates/pa-core/src/auth/manager.rs
context:unanalyzable_binary binary content is only byte-scanned
scripts/release/native-compat/photon_rs_bg.wasm
skill_frontmatter_invalid missing name/description frontmatter
skills/factory/SKILL.md
context:frontmatter_unparseable mapping values are not allowed here
skills/factory/SKILL.md
request_unanswered request.0: invalid file request (evidence_ids not shown in the asking request)
