Skip to content
Report library
Purpose / Documents

Repo Intake And Plan Skill Security Audit

What the author says it does (original text)

Rigor Intake helper for README-first deep learning repo reproduction. Use when the task is specifically to scan a repository, read the README and common project files, extract documented commands, classify inference, evaluation, and training candidates, and return the smallest trustworthy reproduction plan to the main orchestrator. Do not use for environment setup, asset download, command executio

Independent security check

Security risks found

Files checked
5
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

README headings can cause training commands to be labeled as inference or evaluation

Source references: 6
What we found

The classifier accepts the section-heading category before checking the entrypoint filename. For example, train.py under a “Demo” heading is initially labeled inference. The later structure check corrects it only when the script resolves locally, is at most 512 KiB, and reaches a pattern-score threshold; module entrypoints, unavailable scripts, or training implementations outside the limited patterns can remain misclassified.

Why this matters

If a downstream system uses this classification as a training-authorization or cost-control gate, a real training workload could be treated as lower-risk inference or evaluation, consuming substantial compute, changing model artifacts, or launching a long-running job.

The classification bypass is supported. `classify` returns the heading-derived category before checking entrypoint names, so `train.py` under “Demo” is initially labeled inference. Correction only examines a direct `.py` file that exists inside the repository and is at most 512 KiB, and it requires a score of at least four from a limited set of training patterns. Module entrypoints, missing/large scripts, or different training structures can remain misclassified. This could make a plan present training as lower-risk inference, although the skill itself does not execute it. Users can ask the author to prioritize explicit training entrypoints and mark unverifiable entrypoints as uncertain.

scripts/extract_commands.py:84In the codeOpen original file
    # authorization when both appear in the same title.    if any(word in lowered for word in ["training", "train", "finetune", "fine-tune", "pretrain"]):        return "training"    if any(word in lowered for word in ["evaluation", "evaluate", "benchmark", "metrics", "validation"]) or re.search(        r"\b(?:test|tests|testing)\b", lowered    ):        return "evaluation"    if any(word in lowered for word in ["inference", "usage", "demo", "example", "text-to-image", "image-to-image", "transcribe"]):        return "inference"    return None
Show 5 other places
scripts/extract_commands.py:138In the codeOpen original file
    section_category = infer_section_category(section)    if section_category:        return section_category    for pattern, category in SCRIPT_CATEGORY_HINTS:        if pattern.search(lowered):            return category
scripts/extract_commands.py:237In the codeOpen original file
def referenced_python_script(command: str, readme_dir: Path) -> Optional[Path]:    matched = PYTHON_ENTRYPOINT_RE.search(command)    if not matched:        return None    root = readme_dir.resolve()    candidate = (root / matched.group("path")).resolve()    try:        candidate.relative_to(root)    except ValueError:        return None    if not candidate.is_file() or candidate.stat().st_size > 524_288:        return None    return candidate
scripts/extract_commands.py:257In the codeOpen original file
        return []    evidence: List[str] = []    score = 0    for label, pattern, weight in TRAINING_STRUCTURE_SIGNALS:        if pattern.search(content):            evidence.append(label)            score += weight    return evidence if score >= 4 else []
scripts/extract_commands.py:77In the codeOpen original file
def infer_section_category(section: Optional[str]) -> Optional[str]:    if not section:        return None    lowered = section.lower()    # Training is the highest-risk interpretation. Check it before generic    # headings such as "example" or "usage" so they cannot bypass training    # authorization when both appear in the same title.    if any(word in lowered for word in ["training", "train", "finetune", "fine-tune", "pretrain"]):        return "training"    if any(word in lowered for word in ["evaluation", "evaluate", "benchmark", "metrics", "validation"]) or re.search(        r"\b(?:test|tests|testing)\b", lowered    ):        return "evaluation"    if any(word in lowered for word in ["inference", "usage", "demo", "example", "text-to-image", "image-to-image", "transcribe"]):        return "inference"    return None
scripts/extract_commands.py:252In the codeOpen original file
def training_structure_evidence(script: Path) -> List[str]:    try:        content = script.read_text(encoding="utf-8", errors="replace")    except OSError:        return []    evidence: List[str] = []    score = 0    for label, pattern, weight in TRAINING_STRUCTURE_SIGNALS:        if pattern.search(content):            evidence.append(label)            score += weight    return evidence if score >= 4 else []
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Untrusted README commands can flow directly into reproduction recommendations

Source references: 5
What we found

The extractor collects text based on command-like syntax and Markdown position without checking for file deletion, credential upload, remote execution, or other dangerous shell behavior. The Skill then calls for a “minimum trustworthy reproduction recommendation,” so a malicious repository could disguise a harmful command as a documented demo or evaluation step and influence a downstream agent or user.

Why this matters

This Skill does not itself execute the command. However, if an orchestrator or user treats its inventory or recommendation as reviewed and runs it, files, credentials, or accounts could be exposed to destructive or unauthorized operations.

The risk is supported, but the direct impact is misleading the plan or the user's choice, not execution by this skill. The skill extracts README commands and recommends a reproduction target; the extractor only tests whether text looks command-like and then copies it into the inventory, with no visible review for dangerous shell behavior. A malicious repository could therefore present a harmful command as a documented step. The explicit no-install/no-execution boundary limits immediate harm. Users can ask the author to treat README content as untrusted, flag deletion, uploads, credential access, and pipe-to-shell patterns, and prohibit downstream automatic execution.

SKILL.md:42In the instructionsOpen original file
- concise repo structure summary- documented command inventory- inferred candidate categories: inference, evaluation, training, other- minimum trustworthy reproduction recommendation- notable ambiguity or risk list
Show 4 other places
scripts/extract_commands.py:177In the codeOpen original file
def looks_like_command(line: str) -> bool:    candidate = re.sub(r"^(?:\$|PS> )\s*", "", line.strip())    if not candidate or candidate.startswith("#"):        return False    if candidate.startswith(("python", "pip", "conda", "bash", "sh", "make", "docker")):        return True    if candidate.startswith(COMMAND_PREFIXES):        return True    if re.search(r"\s--[A-Za-z0-9_-]+", candidate):        return True    if re.search(r"\b(?:python|pip|conda|torchrun|deepspeed|accelerate|bash|sh)\b", candidate):        return True    if re.search(r"[\\/].+\.(?:py|sh|bat)", candidate):        return True    if candidate.startswith(("cd ", "ls ", "mkdir ", "wget ", "curl ", "git ")):        return True    return False
scripts/extract_commands.py:300In the codeOpen original file
        for line in lines:            if line not in seen:                commands.append(                    {                        "command": line,                        "category": classify(line, section),                        "kind": command_kind(line, section),                        "section": section,                        "source": "code_block",                        "needs_substitution": bool(PLACEHOLDER_RE.search(line)),                    }                )
SKILL.md:27In the instructionsOpen original file
- This skill scans and plans.- This skill is helper-tier and should usually be orchestrator-invoked.- It does not install environments.- It does not prepare large assets.- It does not execute substantive reproduction commands.- It does not decide high-risk patching.
agents/openai.yaml:3In the instructionsOpen original file
short_description: Rigor Intake helper for scanning a repo and recommending the smallest trustworthy reproduction target.default_prompt: Scan this repository, read the README and common project files, extract documented commands, classify inference evaluation and training paths, and recommend the smallest trustworthy reproduction target.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill describes itself as scan-and-plan only: it reads repository structure and README material, extracts and classifies commands, but does not install environments, prepare large assets, or run reproduction workloads.

View source
SKILL.md:27In the instructionsOpen original file
- This skill scans and plans.- This skill is helper-tier and should usually be orchestrator-invoked.- It does not install environments.- It does not prepare large assets.- It does not execute substantive reproduction commands.- It does not decide high-risk patching.

The repository scanner enumerates top-level names, detects common project files and directories, and includes resolved absolute repository and README paths in its output. The shown code contains no network transmission or file writes.

View source
scripts/scan_repo.py:48In the codeOpen original file
    top_level = sorted(item.name for item in root.iterdir())    detected_files = [name for name in KEY_FILES if (root / name).exists()]    detected_dirs = [name for name in SIGNAL_DIRS if (root / name).exists()]    readme = first_existing(root, ["README.md", "README"])
scripts/scan_repo.py:59In the codeOpen original file
    return {        "generated_at": datetime.now(timezone.utc).isoformat(),        "repo_path": str(root.resolve()),        "readme_path": str(readme.resolve()) if readme else None,        "detected_files": detected_files,        "detected_dirs": detected_dirs,        "structure": {            "top_level": top_level,            "top_level_file_count": sum(1 for item in root.iterdir() if item.is_file()),

The command extractor reads the user-specified README and may read referenced Python scripts within the README's directory tree, up to 512 KiB, to look for training-structure signals. Its resolved-path check prevents relative paths or symlinks from escaping that tree.

View source
scripts/extract_commands.py:241In the codeOpen original file
        return None    root = readme_dir.resolve()    candidate = (root / matched.group("path")).resolve()    try:        candidate.relative_to(root)    except ValueError:        return None    if not candidate.is_file() or candidate.stat().st_size > 524_288:        return None    return candidate
scripts/extract_commands.py:362In the codeOpen original file
    readme_path = Path(args.readme)    text = readme_path.read_text(encoding="utf-8", errors="replace")    data = extract_commands(text, readme_path.parent)
Start here · InstructionsSKILL.md
repo-intake-and-plan
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/extract_commands.pyFull text included
  • scripts/scan_repo.pyFull text included
  • references/repo-scan-rules.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
  • references/repo-scan-rules.mdSupporting file
  • scripts/extract_commands.pyScript
  • scripts/scan_repo.pyScript

Operations mentioned in code and instructions

Run commands
scripts/extract_commands.py:27In the codeOpen original file
    "conda ",    "bash ",    "sh ",
scripts/extract_commands.py:181In the codeOpen original file
        return False    if candidate.startswith(("python", "pip", "conda", "bash", "sh", "make", "docker")):        return True
scripts/extract_commands.py:187In the codeOpen original file
        return True    if re.search(r"\b(?:python|pip|conda|torchrun|deepspeed|accelerate|bash|sh)\b", candidate):        return True
Install extra software packages
scripts/extract_commands.py:118In the codeOpen original file
SETUP_PREFIXES = (    "pip install",    "pip3 install",
scripts/extract_commands.py:119In the codeOpen original file
    "pip install",    "pip3 install",    "conda install",
scripts/extract_commands.py:124In the codeOpen original file
    "conda activate",    "python -m pip install",    "git clone",
Connect to websites
scripts/extract_commands.py:128In the codeOpen original file
)ASSET_PREFIXES = ("wget ", "curl ", "mkdir ", "tar ", "unzip ", "7z ", "aria2c ")
scripts/extract_commands.py:191In the codeOpen original file
        return True    if candidate.startswith(("cd ", "ls ", "mkdir ", "wget ", "curl ", "git ")):        return True
Read files
scripts/extract_commands.py:254In the codeOpen original file
    try:        content = script.read_text(encoding="utf-8", errors="replace")    except OSError:
scripts/extract_commands.py:358In the codeOpen original file
    parser = argparse.ArgumentParser(description="Extract shell-like commands from a README.")    parser.add_argument("--readme", required=True, help="Path to the README file.")    parser.add_argument("--json", action="store_true", help="Emit JSON output.")
scripts/extract_commands.py:363In the codeOpen original file
    readme_path = Path(args.readme)    text = readme_path.read_text(encoding="utf-8", errors="replace")    data = extract_commands(text, readme_path.parent)
Lines read
582
File checksum (to compare versions)
080d2e1f9e1de5c2e1dd468908f8f7708ca4fa197edc02a3b285eae5a3566503