# Security Validation Record

Validation date: **2026-07-23** (local project date).

## Baseline

The repository `SECURITY.md` section recorded **10 findings** with maximum severity **CRITICAL**:

- cross-file environment-variable/network exfiltration;
- a multi-file collection/transmission chain;
- environment harvesting in both schematic scripts;
- credential transmission and local `.env` loading;
- subprocess delegation and full-environment propagation;
- fabricated or unverified model identifiers;
- unpinned external dependencies.

The affected files were:

- deleted: scripts/generate_schematic.py;
- deleted: scripts/generate_schematic_ai.py;
- the former credential and mandatory-figure instructions in `SKILL.md`.

## Remediation

- Deleted both external schematic scripts and all former LaTeX/figure assets.
- Removed credential declarations, environment access, `.env` loading, subprocesses, HTTP requests, external models, image generation, mandatory figures, and cross-skill behavior.
- Replaced the workflow with bounded deterministic local JSON/CSV/Markdown validators and a preregistration scaffold generator.
- Added strict duplicate-key/header detection, size/row/cell/list limits, symlink and URL-path rejection, private atomic outputs, and no implicit overwrite.
- Added AST tests rejecting network libraries, subprocesses, executable serialization, dynamic code execution, and environment credential access.
- Added local-first confidentiality, source verification, human accountability, ethics, biosafety, dual-use, data, clinical-scope, and regulatory gates.
- Tools report declarations and cross-links only; they do not score or select hypotheses.

## Validation results

- Agent Skills reference validator: **PASS**
- Dependency-free CLI help checks: **PASS** for all 7 public CLIs
- Synthetic standard-library tests: **27 passed**
- Explicit AST parse with bytecode disabled: **8 scripts parsed**
- Bytecode artifacts: **0**
- IDE lints: **0**
- Documented local-path link test: **PASS**
- Authoritative-source link extraction: **36/36 reachable, 0 errors**
- Direct behavioral security scan: **SAFE, 0 findings**
- Pull-request gate with `--fail-on HIGH`: **PASS**
  - CRITICAL: 0
  - HIGH: 0
  - LOW: 2

## Residual LOW findings

The LLM-assisted pull-request scan reported:

1. **Missing `allowed-tools` declaration** — informational. The Agent Skills specification does not require this optional field. The compatibility declaration and body constrain bundled tools to bounded local standard-library processing with no network, models, images, credentials, or environment access.
2. **Missing referenced files** — analyzer false positive. It invented paths under `templates/` and mismatched existing `assets/` and `references/` files. The deterministic local-path test resolved every documented bundled path and passed. No script implements network fallback or substitute retrieval.

Neither LOW finding permits data transmission, credential access, scientific scoring, or automatic hypothesis selection. No CRITICAL or HIGH issue remains.

## Reproduction

```bash
PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover \
  -s tests/hypothesis-generation -p "test_*.py" -v

uv run skills-ref validate skills/hypothesis-generation

uv run skill-scanner scan skills/hypothesis-generation --use-behavioral

uv run python scan_pr_skills.py \
  --fail-on HIGH \
  --output /tmp/hypothesis-generation-pr-scan.md \
  skills/hypothesis-generation
```

The repository-level `SECURITY.md` is intentionally not edited in this scoped refresh; its generated snapshot updates through the repository’s normal scan process.