Security Validation Record

Validation date: 2026-07-23 (local project date).

Baseline

The repository SECURITY.md entry recorded 10 findings with maximum severity CRITICAL:

Cross-file environment-variable and network exfiltration
A multi-file collection/transmission chain
Environment harvesting in both schematic scripts
API-key transmission to an external model service
Full environment propagation to a subprocess
Repeated costly model/image operations
Mandatory external schematic/cross-skill behavior

The affected files were:

Deleted: scripts/generate_schematic.py
Deleted: scripts/generate_schematic_ai.py
The former SKILL.md

Remediation

Deleted both external schematic scripts.
Removed credentials, environment access, .env loading, subprocess chaining, network requests, model calls, image generation, mandatory figures, and cross-skill calls.
Replaced them with bounded deterministic local JSON/CSV/Markdown validators and generators.
Added strict schemas, duplicate-key/header detection, size/row/cell limits, symlink rejection, private atomic output, and no implicit overwrite.
Added report minimization: IDs, counts, rule codes, and line numbers instead of manuscript/review prose.
Added AST tests that reject network libraries, executable serialization, dynamic code execution, and environment credential access.
Added confidentiality, no-reuse, authorization, conflict, competence, AI-policy, disclosure, and deletion/retention gates.

Validation results

Agent Skills reference validator: PASS
Dependency-free CLI help checks: PASS
Synthetic standard-library tests: 26 passed
Explicit AST parse with bytecode disabled: 8 scripts parsed
Bytecode artifacts: 0
IDE lints: 0
Documented local-path link test: PASS
Markdown link check: PASS (access-controlled HTTP 403 treated as reachable)
Direct behavioral security scan: SAFE, 0 findings
Pull-request gate with --fail-on HIGH: PASS
CRITICAL: 0
HIGH: 0
LOW: 3

Residual LOW findings

The final LLM-assisted pull-request scan reported:

Missing allowed-tools declaration — informational. This field is optional under the Agent Skills specification. The compatibility and body explicitly constrain bundled tools to local standard-library processing with no network, model, image, credential, or environment access.
Broad description — accepted as a scoped capability description. The mandatory authorization and venue-policy gate applies before confidential content is read, and the body limits all functions to peer-review assessment.
Bounded CSV/JSON processing — defensive observation with “no action required” in the scanner output. Inputs are already limited to 4 MiB, 5,000 CSV rows, 12,000 characters per cell, and finite list sizes; tests cover oversize rejection.

None of the LOW findings permits data transmission or credential access. No CRITICAL or HIGH issue remains.

Reproduction

PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover \
  -s tests/peer-review -p "test_*.py" -v

uv run skills-ref validate skills/peer-review

uv run skill-scanner scan skills/peer-review --use-behavioral

uv run python scan_pr_skills.py \
  --fail-on HIGH \
  --output /tmp/peer-review-pr-scan.md \
  skills/peer-review

The repository-level SECURITY.md was intentionally not edited in this scoped refresh; its generated snapshot will update through the repository’s normal scan process.