{"data":{"skill":{"slug":"cubha-team-dev","name":"team-dev","icon":"📦","repo":"https://github.com/cubha/claude-workflow-plugins/tree/3172e1a00f7090579f36af20c046828489983c23/plugins/team-dev/skills/team-dev","status":"approved","author":"cubha","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"5ad5d0b4-7579-42ae-b996-0e5a834755ab","skill_id":"138dd317-baa8-46e8-90d5-6886db740696","version":3,"content_hash":"v3:c43861a65bb95efcae259cd161c9d6f4dc7eec6f:01bbcbcde21c516111daae184c465881bec3bba20a22ac569c2510d2e715a701:d8f10e8151c1e89e8aa8c15155c66d8b70bb69dc602e300d731810b45e629b85:736b696c6c732f63756268612f7465616d2d646576:1a2fe48b6244a712059566341f2349f1","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Four command-execution findings are confirmed because the workflow runs repository-provided tests and verification scripts. Sixteen Markdown backtick findings and four entropy findings are false positives, but prompt propagation and automatic integration create additional security concerns.","remediation":[{"issue":"Repository-provided test and verification commands can execute untrusted code.","severity":"medium","suggestion":"Inspect command definitions and require explicit user confirmation before execution, especially in auto mode. Run approved commands in a restricted environment."},{"issue":"Project rule files are inserted into subagent prompts without a trust boundary.","severity":"high","suggestion":"Treat repository instructions as untrusted data, reject precedence-changing directives, and pass only reviewed project facts to subagents."},{"issue":"The design prompt explicitly tells another skill to override its default directives.","severity":"high","suggestion":"Replace precedence language with scoped design requirements that cannot override system, security, or tool policies."},{"issue":"Agent branches are merged and conflicts may be edited without a dedicated review gate.","severity":"medium","suggestion":"Merge into a temporary integration branch, show the diff and verification results, and require approval before updating the main branch."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"phase-dispatch.md","line_end":69,"line_start":59},{"file":"phase-dispatch.md","line_end":69,"line_start":69},{"file":"phase-dispatch.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":14,"line_start":12},{"file":"SKILL.md","line_end":20,"line_start":14},{"file":"SKILL.md","line_end":23,"line_start":20},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":99,"line_start":68},{"file":"SKILL.md","line_end":100,"line_start":99},{"file":"SKILL.md","line_end":102,"line_start":100},{"file":"SKILL.md","line_end":117,"line_start":102},{"file":"SKILL.md","line_end":125,"line_start":117},{"file":"SKILL.md","line_end":127,"line_start":125},{"file":"SKILL.md","line_end":142,"line_start":127},{"file":"SKILL.md","line_end":146,"line_start":142},{"file":"SKILL.md","line_end":154,"line_start":146},{"file":"SKILL.md","line_end":155,"line_start":154},{"file":"SKILL.md","line_end":156,"line_start":155},{"file":"SKILL.md","line_end":156,"line_start":156}]}],"critical_findings":[],"high_findings":[{"title":"Prompt Injection Attempt Detected","locations":[{"file":"phase-analyze.md","line_end":85,"line_start":85}],"confidence":0.99,"description":"The prompt template states \"CONSISTENCY LOCK — OVERRIDE DEFAULT VARIATION DIRECTIVES.\" It is placed at the top of another skill prompt and claims precedence over existing directives.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The source contains explicit override language and directs the orchestrator to inject it into a downstream prompt."},{"title":"Untrusted Repository Instructions Propagated to Agents","locations":[{"file":"phase-analyze.md","line_end":36,"line_start":34},{"file":"phase-dispatch.md","line_end":30,"line_start":29}],"confidence":0.97,"description":"The workflow reads project rule files such as CLAUDE.md and inserts their contents into subagent prompts without validation or a trust boundary.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Both collection and direct prompt insertion are explicitly documented, and no filtering or precedence defense is specified."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"phase-dispatch.md","line_end":69,"line_start":59}],"confidence":0.92,"description":"1. 미구현 동작에 대한 단위 테스트(`*.test.*`)를 먼저 작성 → 실행 → **RED 확인**","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited range directs an agent to execute tests and then run a project verification script. Repository test and build commands can execute untrusted project code."},{"title":"Ruby/shell backtick execution","locations":[{"file":"phase-dispatch.md","line_end":69,"line_start":69}],"confidence":0.98,"description":"4. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test`·`npm run build` 등). 없으면 정적 검증 단계를 생략한","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The instruction explicitly runs bash verify.sh, npm test, or npm run build. These repository-controlled commands can execute arbitrary local scripts."},{"title":"Ruby/shell backtick execution","locations":[{"file":"phase-dispatch.md","line_end":114,"line_start":114}],"confidence":0.98,"description":"5. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test` 등).","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The team-mode prompt explicitly requires execution of repository verification commands. No inspection, sandboxing, or confirmation requirement is stated."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":23,"line_start":23}],"confidence":0.97,"description":"- **검증 스크립트(선택)** — `verify.sh`·`npm test`·`npm run build` 등 프로젝트 검증 수단이 있으면 각 SubTask 완료 후 및 통합 시 실","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line instructs the workflow to execute repository verification commands after subtasks and integration. Shell and package scripts can run untrusted project code."},{"title":"Automatic Integration of Agent-Generated Branches","locations":[{"file":"phase-verify.md","line_end":13,"line_start":6}],"confidence":0.96,"description":"The workflow merges agent branches into the main branch and may attempt conflict resolution before requesting user judgment.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The merge commands and automatic conflict-resolution sequence are explicit, creating a clear code-integrity risk without a mandatory review gate."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":549,"audit_model":"codex","audited_at":"2026-07-23T13:06:26.957+00:00","created_at":"2026-07-24T13:46:35.50184+00:00","static_findings":[{"id":"external_commands:phase-dispatch.md:59:ruby-shell-backtick-execution","file":"phase-dispatch.md","pattern":"Ruby/shell backtick execution","snippet":"1. 미구현 동작에 대한 단위 테스트(`*.test.*`)를 먼저 작성 → 실행 → **RED 확인**","category":"external_commands","line_end":69,"severity":"medium","line_start":59},{"id":"external_commands:phase-dispatch.md:69:ruby-shell-backtick-execution","file":"phase-dispatch.md","pattern":"Ruby/shell backtick execution","snippet":"4. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test`·`npm run build` 등). 없으면 정적 검증 단계를 생략한","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:phase-dispatch.md:114:ruby-shell-backtick-execution","file":"phase-dispatch.md","pattern":"Ruby/shell backtick execution","snippet":"5. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test` 등).","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":14,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":20,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Git 저장소 필수** — worktree 격리를 위해 `git init`이 완료된 상태여야 한다","category":"external_commands","line_end":23,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **검증 스크립트(선택)** — `verify.sh`·`npm test`·`npm run build` 등 프로젝트 검증 수단이 있으면 각 SubTask 완료 후 및 통합 시 실","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **TDD 의미론**: 인터랙티브(`--auto` 없음)에서는 적격 SubTask에 `[TDD]`를 붙여 Phase 1-6 승인게이트에 제안 노출한다. `--auto` 단독이면","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`run_in_background: true`로 실행했으므로, 각 에이전트 완료 시 자동 알림을 받는다.","category":"external_commands","line_end":99,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 승인 / `next` | 다음 그룹 Phase 2로 진행 |","category":"external_commands","line_end":100,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--auto` | auto 모드 ON — 남은 그룹 전부 자동 진행 |","category":"external_commands","line_end":102,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `stop` | 중단 |","category":"external_commands","line_end":117,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"응답 마지막에 `---DONE---` 블록을 포함한다.","category":"external_commands","line_end":142,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":154,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--auto` | 그룹 간 자동 진행 (FAIL 시 자동 해제) |","category":"external_commands","line_end":155,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--dry-run` | 의존성 분석 + 그룹 분류만 수행, 실제 구현 안 함 |","category":"external_commands","line_end":156,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--tdd` / `--no-tdd` | TDD RED 게이트 발동 / 완전 끔 (Phase 0 참조) |","category":"external_commands","line_end":156,"severity":"medium","line_start":156},{"id":"obfuscation:phase-analyze.md:1:heuristic-high-file-entropy-6-50-bits-possible-b","file":"phase-analyze.md","pattern":"[HEURISTIC] High file entropy (6.50 bits) - possible binary/encrypted content","snippet":"File: phase-analyze.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:phase-dispatch.md:1:heuristic-high-file-entropy-6-63-bits-possible-b","file":"phase-dispatch.md","pattern":"[HEURISTIC] High file entropy (6.63 bits) - possible binary/encrypted content","snippet":"File: phase-dispatch.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:phase-verify.md:1:heuristic-high-file-entropy-6-01-bits-possible-b","file":"phase-verify.md","pattern":"[HEURISTIC] High file entropy (6.01 bits) - possible binary/encrypted content","snippet":"File: phase-verify.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-48-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.48 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:phase-dispatch.md:59:ruby-shell-backtick-execution","reason":"The cited range directs an agent to execute tests and then run a project verification script. Repository test and build commands can execute untrusted project code.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"external_commands:phase-dispatch.md:69:ruby-shell-backtick-execution","reason":"The instruction explicitly runs bash verify.sh, npm test, or npm run build. These repository-controlled commands can execute arbitrary local scripts.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:phase-dispatch.md:114:ruby-shell-backtick-execution","reason":"The team-mode prompt explicitly requires execution of repository verification commands. No inspection, sandboxing, or confirmation requirement is stated.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"This line is an opening Markdown code fence for a workflow diagram. It does not invoke Ruby, a shell, or any external command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"This line closes a Markdown code fence. The enclosed content is a plain workflow diagram, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The inline git init text documents a repository prerequisite. This line does not instruct the skill to execute git init.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The line instructs the workflow to execute repository verification commands after subtasks and integration. Shell and package scripts can run untrusted project code.","verdict":"confirmed","severity":"medium","confidence":0.97},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format command-line option names and a TDD label in explanatory text. They do not perform shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The inline text names an agent tool parameter. It is configuration documentation rather than Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The backticks format the user response next in a behavior table. No external process is started.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The backticks format the --auto option in a behavior table. This is not shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The backticks identify stop as a user response. They do not execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence around a completion-report example. It has no executable shell content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"This line closes a Markdown example block. It is not a Ruby or shell backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The backticks format a required response marker. The marker is plain output text and is not executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"This line opens a Markdown block containing guidance about task counts. It does not execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"This line closes a Markdown guidance block. It is not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The backticks format the --auto option in a reference table. No shell interpolation occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"The backticks format the --dry-run option in a reference table. This line describes behavior without executing a process.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"The backticks format the --tdd and --no-tdd options. They are documentation, not executable backtick expressions.","verdict":"false_positive","confidence":1},{"id":"obfuscation:phase-analyze.md:1:heuristic-high-file-entropy-6-50-bits-possible-b","reason":"The file is readable Markdown containing Korean and English workflow documentation, tables, and prompt templates. No binary, encrypted, or encoded payload is present.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:phase-dispatch.md:1:heuristic-high-file-entropy-6-63-bits-possible-b","reason":"The file is readable Markdown with multilingual instructions, tables, and formatting characters. Its entropy reflects varied natural-language content, not obfuscation.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:phase-verify.md:1:heuristic-high-file-entropy-6-01-bits-possible-b","reason":"The file is readable Markdown describing Git merges and verification steps. No binary or encrypted content is present.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-48-bits-possible-b","reason":"SKILL.md is readable Korean and English documentation with tables and diagrams. The content is neither encoded nor concealed.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Prompt Injection Attempt Detected","severity":"high","locations":[{"file":"phase-analyze.md","line_end":85,"line_start":85}],"confidence":0.99,"description":"The prompt template states \"CONSISTENCY LOCK — OVERRIDE DEFAULT VARIATION DIRECTIVES.\" It is placed at the top of another skill prompt and claims precedence over existing directives.","confidence_reasoning":"The source contains explicit override language and directs the orchestrator to inject it into a downstream prompt."},{"title":"Untrusted Repository Instructions Propagated to Agents","severity":"high","locations":[{"file":"phase-analyze.md","line_end":36,"line_start":34},{"file":"phase-dispatch.md","line_end":30,"line_start":29}],"confidence":0.97,"description":"The workflow reads project rule files such as CLAUDE.md and inserts their contents into subagent prompts without validation or a trust boundary.","confidence_reasoning":"Both collection and direct prompt insertion are explicitly documented, and no filtering or precedence defense is specified."},{"title":"Automatic Integration of Agent-Generated Branches","severity":"medium","locations":[{"file":"phase-verify.md","line_end":13,"line_start":6}],"confidence":0.96,"description":"The workflow merges agent branches into the main branch and may attempt conflict resolution before requesting user judgment.","confidence_reasoning":"The merge commands and automatic conflict-resolution sequence are explicit, creating a clear code-integrity risk without a mandatory review gate."}],"subject_marketplace_commit_sha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","subject_content_hash":"01bbcbcde21c516111daae184c465881bec3bba20a22ac569c2510d2e715a701","subject_tree_hash":"d8f10e8151c1e89e8aa8c15155c66d8b70bb69dc602e300d731810b45e629b85","subject_plugin_path":"skills/cubha/team-dev","audit_payload_hash":"1a2fe48b6244a712059566341f2349f1","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","contentHash":"01bbcbcde21c516111daae184c465881bec3bba20a22ac569c2510d2e715a701","treeHash":"d8f10e8151c1e89e8aa8c15155c66d8b70bb69dc602e300d731810b45e629b85","pluginPath":"skills/cubha/team-dev","auditPayloadHash":"1a2fe48b6244a712059566341f2349f1"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/cubha-team-dev/audits/3/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}