🎯

감사 이력

github-project-management - 4 감사들

감사 버전 4

최신 낮은 위험

Jan 17, 2026, 07:29 AM

This is a documentation-only skill containing example bash scripts for GitHub CLI operations. The static analyzer flagged 185 potential issues, but 99% are false positives. The 'shell backtick execution' findings are actually POSIX shell command substitution ($()) used in legitimate gh CLI examples. The 'weak cryptographic algorithm' findings are misidentified base64 strings in URLs/metadata. The 'system reconnaissance' findings are standard GitHub CLI commands (gh issue list, gh project list) for project management. All detected patterns are standard documentation for a legitimate GitHub project management tool.

2
스캔된 파일
1,515
분석된 줄 수
2
발견 사항
claude
감사자
보안 문제를 찾지 못했습니다

위험 요인

⚙️ 외부 명령어 (1)
🌐 네트워크 접근 (1)

감사 버전 3

낮은 위험

Jan 17, 2026, 07:29 AM

This is a documentation-only skill containing example bash scripts for GitHub CLI operations. The static analyzer flagged 185 potential issues, but 99% are false positives. The 'shell backtick execution' findings are actually POSIX shell command substitution ($()) used in legitimate gh CLI examples. The 'weak cryptographic algorithm' findings are misidentified base64 strings in URLs/metadata. The 'system reconnaissance' findings are standard GitHub CLI commands (gh issue list, gh project list) for project management. All detected patterns are standard documentation for a legitimate GitHub project management tool.

2
스캔된 파일
1,515
분석된 줄 수
2
발견 사항
claude
감사자
보안 문제를 찾지 못했습니다

위험 요인

⚙️ 외부 명령어 (1)
🌐 네트워크 접근 (1)

감사 버전 2

중간 위험

Jan 6, 2026, 07:44 AM

This skill provides legitimate GitHub project management capabilities using CLI tools and MCP servers. While it requires broad permissions for GitHub operations and executes external commands, these capabilities are necessary for its stated purpose. The skill uses standard GitHub CLI (gh) and documented MCP tools without any obfuscated or suspicious code patterns.

1
스캔된 파일
1,278
분석된 줄 수
5
발견 사항
claude
감사자
중간 위험 문제 (1)
Broad GitHub CLI permissions required
The skill requires GitHub CLI with authenticated access and repository permissions. While legitimate for project management, this grants write access to issues, projects, and repository data. Users should ensure they trust the skill operator and understand the scope of permissions being granted.
낮은 위험 문제 (1)
External command execution via GitHub Actions
The skill includes GitHub Actions workflows that execute external commands. While this is standard for CI/CD, it could potentially run arbitrary code if the repository is compromised. The workflow files appear legitimate and follow standard patterns.

위험 요인

🌐 네트워크 접근 (1)
📁 파일 시스템 액세스 (1)
⚙️ 외부 명령어 (1)

감사 버전 1

중간 위험

Jan 6, 2026, 07:44 AM

This skill provides legitimate GitHub project management capabilities using CLI tools and MCP servers. While it requires broad permissions for GitHub operations and executes external commands, these capabilities are necessary for its stated purpose. The skill uses standard GitHub CLI (gh) and documented MCP tools without any obfuscated or suspicious code patterns.

1
스캔된 파일
1,278
분석된 줄 수
5
발견 사항
claude
감사자
중간 위험 문제 (1)
Broad GitHub CLI permissions required
The skill requires GitHub CLI with authenticated access and repository permissions. While legitimate for project management, this grants write access to issues, projects, and repository data. Users should ensure they trust the skill operator and understand the scope of permissions being granted.
낮은 위험 문제 (1)
External command execution via GitHub Actions
The skill includes GitHub Actions workflows that execute external commands. While this is standard for CI/CD, it could potentially run arbitrary code if the repository is compromised. The workflow files appear legitimate and follow standard patterns.

위험 요인

🌐 네트워크 접근 (1)
📁 파일 시스템 액세스 (1)
⚙️ 외부 명령어 (1)