Is skills/immigration-document-checklist safe?
The immigration-document-checklist skill is a pure markdown advisory tool with no executable code, no prompt injection attempts, and no data exfiltration vectors. All suspicious filesystem and network activity observed in monitoring logs is attributable to the audit framework's own infrastructure (pre-install canary reads, Ubuntu update services, GitHub clone) rather than the skill itself, and the canary integrity check explicitly confirms no honeypot files were compromised. The skill is safe to install and functions exactly as advertised: organizing immigration document preparation with appropriate legal disclaimers.
Category Scores
Findings (4)
INFO SKILL.md is entirely clean — no injection vectors present 0 ▶
The skill file contains only legitimate instructional content: a document checklist framework, output format templates, quality checks, anti-patterns, and example trigger phrases. There are no hidden instructions, no requests to ignore prior instructions, no persona switches, no external URL fetch directives, no invisible unicode, no HTML comments, and no attempts to escalate agent permissions. The legal disclaimer is appropriate and does not attempt to manipulate agent behavior.
INFO Zero executable content — pure markdown only 0 ▶
The skill repository contains exactly one file: SKILL.md. There is no package.json, no npm install scripts, no git hooks (.githooks/ absent), no .gitattributes filter drivers, no .gitmodules, no symlinks, and no shell scripts. The filesystem diff confirms only SKILL.md was installed. No code can execute at install time or runtime via this skill.
INFO GitHub clone connection is expected and authorized 0 ▶
The only external network connection attributable to the installation process is to 140.82.121.3:443 (GitHub's IP), initiated by git-remote-http during the supervised sparse checkout. This is the expected and intended network activity for skill installation from a GitHub repository.
INFO All honeypot files intact — canary verification passed 0 ▶
The monitoring system confirms all canary files (.env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were unmodified after installation. Read accesses to these files are temporally and contextually attributed to the audit framework's own pre/post baseline verification steps, not to any skill-originated activity.