elixir-security-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited elixir-security-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Issue Type | Reference |
|---|---|
| Code.eval_string, binary_to_term | references/code-injection.md |
| String.to_atom dangers | references/atom-exhaustion.md |
| Config, environment variables | references/secrets.md |
| ETS visibility, process dictionary | references/process-exposure.md |
Code.eval_string/1 on user input:erlang.binary_to_term/1 without :safe on untrusted dataString.to_atom/1 on external input| Issue | Flag ONLY IF |
|---|---|
| String.to_atom | Input comes from external source (user, API, file) |
| binary_to_term | Data comes from untrusted source |
| ETS :public | Contains sensitive data |
Complete in order for each finding you intend to report. Do not advance until the pass condition is satisfied.
[FILE:LINE] (or a line range) that you copied from the current file contents; the path resolves in this repo.conn.params, Jason.decode!/1 result, uploaded file path, message from another node) or you drop the finding because the value is compile-time, test-only, or internal per Context-Sensitive Rules.Use the issue format: [FILE:LINE] ISSUE_TITLE for each finding.
Hard gate 4 requires review-verification-protocol; use it as the full pre-report checklist and issue-type verification (it extends beyond this skill’s summary).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.