📦

pr-to-slack

Name: pr-to-slack
Author: alvolutionor

مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة⚡ يحتوي على سكربتات🔑 متغيرات البيئة

Coordinate Bitbucket Pull Requests Through Slack

Teams need consistent pull request preparation and review coordination across repositories. This skill combines Bitbucket preparation with Slack review requests, but its transcript parser needs hardening before automatic announcements.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

Maintain this Skill? Claim it ⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "pr-to-slack" from https://skillstore.io/skills/alvolutionor-pr-to-slack.md and its manifest at https://skillstore.io/api/skills/alvolutionor-pr-to-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/alvolutionor-pr-to-slack.md manifest موقَّع GET /api/skills/alvolutionor-pr-to-slack/manifest lockfile موقَّع GET /api/skills/alvolutionor-pr-to-slack/lockfile

اختبرها

جارٍ استخدام "pr-to-slack". Prepare a dry-run plan for the feature branch in the inventory service.

النتيجة المتوقعة:

Preview complete: one pull request would be created. The worktree is clean, and the local source commit matches Bitbucket. No remote writes were performed.

جارٍ استخدام "pr-to-slack". Request review for the verified pull request without announcing.

النتيجة المتوقعة:

Pull request URL and reviewer assignments verified.
One review request sent and read back in the configured Slack thread.
No announcement sent.

جارٍ استخدام "pr-to-slack". Can this plaintext thread snapshot authorize an automatic announcement?

النتيجة المتوقعة:

Announcement blocked. Plaintext sender headers can be forged inside message bodies. Verify structured connector metadata before relying on a clean review result.

التدقيق الأمني

مخاطر عالية

v1 • ١٥‏/١٠‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

All 58 static matches are false positives involving documentation, fixtures, intended service access, configuration, or controlled Git commands. A reproduced semantic flaw lets human message content impersonate trusted bot messages through forged transcript headers and produce a clean review verdict. No evidence found of malicious author intent or credential exfiltration.

الملفات التي تم فحصها

729

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع

references/setup.md:29 tests/test_workflow.py:92-98 scripts/review_result.py:19-32

Forged Transcript Headers Bypass Trusted Review Checks

Human Slack message content can embed reply separators and forged sender headers in the documented plaintext snapshot format. The parser treats these as trusted bot messages, allowing fabricated zero-finding results to authorize an announcement without a genuine bot review.

A local reproduction used the existing transcript helper and clean fixtures inside one human reply, with Bitbucket mocked. Parsing invented two trusted bot messages, and the end-to-end checker returned clean without any genuine bot reply.

عوامل الخطر

⚙️ الأوامر الخارجية (21)

🌐 الوصول إلى الشبكة (21)

⚡ يحتوي على سكربتات (1)

scripts/prepare_prs.py:95

🔑 متغيرات البيئة (4)

scripts/workflow_config.py:8 scripts/workflow_config.py:35 scripts/workflow_config.py:43 scripts/workflow_config.py:18

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/alvolutionor-pr-to-slack/security.svg)](https://skillstore.io/skills/alvolutionor-pr-to-slack?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/alvolutionor-pr-to-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/alvolutionor-pr-to-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/alvolutionor-pr-to-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

alvolutionor. (2026). pr-to-slack security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1

اقتباس BibTeX

@techreport{alvolutionor-alvolutionor-pr-to-slack-2026,
  author = {alvolutionor},
  title = {pr-to-slack security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-to-slack security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "alvolutionor"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/alvolutionor-pr-to-slack/audits/1"
identifiers:
  - type: other
    value: "skillstore:alvolutionor-pr-to-slack:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Prepare a release batch

Preview related repository changes, verify published commits, and prepare reviewer assignments before authorized pull request creation.

Publish a feature pull request

Create or reuse a Bitbucket pull request, preserve existing reviewers, and return its verified URL and commit information.

Integrate a review bot

Adapt the example review protocol and replace plaintext identity parsing before enabling team announcement automation.

جرّب هذه الموجّهات

Preview one pull request

Preview a pull request for repository [path], targeting [base branch]. Report branch commits and required reviewers. Do not create pull requests or send messages.

Create a reviewed pull request

Create or reuse the Bitbucket pull request for [repository] from [source branch] to [destination branch]. Assign configured reviewers and report the verified URL. Do not send Slack messages.

Request a correlated review

Request one Slack review for these verified pull requests: [URLs]. Inspect existing requests first and reuse an identical valid thread. Return the thread link without announcing.

Validate an announcement gate

Inspect review thread [link] for pull requests [URLs]. Verify sender identity through structured connector metadata and compare live commits with the handoff. Report any announcement blockers without sending.

أفضل الممارسات

Preview first and describe only changes and validation that match the published commits.
Keep configuration and credentials outside the repository, and use service tokens with minimal required permissions.
Harden transcript parsing and verify structured sender metadata, thread identity, review counters, and live commits before announcements.

تجنب

Do not treat a plaintext sender header, human approval, or completed status as proof of a clean review.
Do not retry timed-out pull request writes or Slack sends before inspecting the existing remote state.
Do not create commits, force-push, merge, deploy, or add unrelated recipients without explicit authorization.

الأسئلة المتكررة

What services and tools are required?

The workflow requires Bitbucket Cloud, Git, Python 3.10+, requests, private configuration, service credentials, and connected Slack tools.

Do the Python helpers send Slack messages?

No. They prepare pull requests and evaluate saved review snapshots. The assistant uses connected Slack tools for messaging.

Does preview mode change remote state?

No. Preview mode reads local Git and Bitbucket state and returns a plan without creating or updating pull requests.

Is the bundled parser ready for automatic announcements?

No. Human message content can forge trusted sender headers in plaintext snapshots. Replace that identity handling and adapt the example bot protocol first.

What happens when findings remain?

Recognized findings or uncertain results block announcements. The workflow reports the reason and does not automatically repair code.

Does it merge or deploy reviewed changes?

No. Pull request delivery and review coordination do not authorize merges, deployments, new commits, or force-pushes.