# Security Validation Record

Validation date: **2026-07-23** (local project date).

## Baseline

The repository `SECURITY.md` section recorded 11 findings:

- 3 CRITICAL findings for cross-file environment-variable/network exfiltration behavior;
- 1 HIGH finding for transmitting a credential to an external service;
- 5 MEDIUM findings for command chaining, credential flow, undeclared network use, and environment harvesting;
- 2 LOW findings for mandatory cross-skill invocation and dependency concerns.

The affected external schematic wrappers were the now-deleted files
`generate_schematic.py` and `generate_schematic_ai.py`.

## Remediation

- Deleted both schematic-generation scripts.
- Removed all external service, LLM, image, credential, and environment-variable behavior.
- Removed mandatory figures and cross-skill calls.
- Replaced unsafe person-level classification and care-pathway helpers with aggregate or planning-only tools.
- Added bounded local JSON handling, person-level-key rejection, output limits, and deterministic schemas.
- Added static AST tests that reject network libraries, dynamic code execution, credential access, and executable serialization.

## Post-Refresh Results

- Direct behavioral scan: **SAFE, 0 findings**.
- Pull-request gate with `--fail-on HIGH`: **passed** with 0 CRITICAL and
  0 HIGH. Repeated LLM-assisted runs returned 2–3 LOW findings because the
  analyzer is nondeterministic.

## Accepted LOW Findings

Across repeated runs, the nondeterministic analyzer reported different subsets of
these LOW observations:

1. **Optional `allowed-tools` field absent** — accepted as informational. The
   Agent Skills specification does not require it; compatibility and runtime
   instructions explicitly prohibit network and credential access.
2. **Broad description** — accepted. The scope intentionally covers the related research-evaluation artifacts requested for this safety refresh, while the frontmatter and first body section explicitly exclude care and live operation.
3. **Person-level key filtering uses a denylist** — accepted as a documented limitation, not a privacy guarantee. Input is contractually restricted to synthetic or aggregate schemas, common person-level fields are rejected as defense in depth, and the documentation repeatedly requires qualified privacy review. The filter cannot detect every identifier name or sensitive value and is never presented as de-identification.
4. **Occasional missing-file report** — accepted as an analyzer false
   positive. Some runs invented a `templates/` directory and nonexistent
   `assets/*.md` references. The deterministic
   `test_documented_local_paths_exist` check resolves every documented local
   path and passes.

None of the accepted findings permits network access, sensitive-data handling, or clinical action.

## Reproduction

```bash
uv run skill-scanner scan skills/clinical-decision-support --use-behavioral

uv run python scan_pr_skills.py \
  --fail-on HIGH \
  --output /tmp/clinical-decision-support-pr-scan.md \
  skills/clinical-decision-support
```