REPORT 01M7BKVCFW69NMHTTDBHRJ3H45 · checks-v2
codeql skill: automated checks
What HostedMCP checked on 13 Nov 2026, 23:28 UTC in trailofbits/skills/plugins/static-analysis/skills/codeql on the default branch. Every result links to the public source it came from, so you can check it yourself.
Passed HostedMCP checks v2
80/100
6 of 6 checks ran · 0 high findings · not a security audit
- Checked
- 13 Nov 2026, 23:28 UTC
- Files read
- SKILL.md and scripts
- Methodology
- checks-v2
Origin
25 / 35 points- BestandenSource Repository verknüpft und erreichbar15 pts
trailofbits/skills/plugins/static-analysis/skills/codeql is public and reachable
github.com/trailofbits/skills/tree/HEAD/plugins/static-analysis/skills ↗ - Befund
- BestandenCommit oder Release im letzten Jahr10 pts
Last commit 2026-11-11
github.com/trailofbits/skills/commits ↗
Scripts
30 / 30 points- BestandenKeine Download-und-Ausführen-Muster oder Zugangsdatendiebstahl in Skripten30 pts
5 of 15 scripts read; no download-and-run, remote eval, base64 execution or credential upload
Instructions to the agent
25 / 35 points- BestandenKeine versteckten Anweisungen in SKILL.md25 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/trailofbits/skills/blob/HEAD/plugins/static-analysis/skills ↗ - BefundVorab erlaubte Tools sind eingeschränkt10 pts
Bash lets the agent run any shell command without asking
github.com/trailofbits/skills/blob/HEAD/plugins/static-analysis/skills ↗
What these checks do not cover
- Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
- Results describe trailofbits/skills/plugins/static-analysis/skills/codeql on the date above; a later commit can differ.
- A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.