This report does not block or authorize the manifest or ZIP.
Static analysis correctly identified extensive shell, filesystem, and network behavior, but many individual hits are Markdown examples or translated copies rather than standalone executable code. The skill intent is legitimate git-based sharing, yet it asks for broad Claude Bash permissions, moves files under ~/.claude, creates symlinks, invokes other skills, and can push local skill contents to git remotes, so it should not be published without human review and explicit user warnings.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 5,845 Lines analyzed
8 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The allow workflow instructs users to add wide Bash permissions for reading ~/.claude files, finding files under ~/.claude, moving skills, creating symlinks, and running any git command. This is intended functionality, but it greatly increases blast radius if a malicious skill name, remote, or later instruction is introduced.
The permission list is explicit and grants broad command patterns. The risk is semantic rather than accidental because the skill asks users to persist these permissions in Claude Code settings.
Local Skill Directory Move And Symlink Replacement
The migration flow moves a skill from ~/.claude/skills into a code repository and replaces the original path with a symlink. This can alter local assistant behavior and could move unintended directories if skill name handling is weak.
The file move and symlink operations are clearly documented. The skill includes some overwrite checks, but the operation still modifies core local skill storage.
Potential Publication Of Private Local Skill Content
The workflow can add a git remote and push migrated skill content, then later commit and push documentation and translations. This can expose private prompts, local notes, or proprietary skill content if users do not review the target remote and files first.
The git push commands and remote configuration flow are explicit. This is legitimate for sharing, but it is a high-impact data exposure path.
The verification script checks for ~/.claude/share-skill-config.json and reads fields from it. It does not exfiltrate the data, but it touches home-directory configuration outside the repository.
The script path and config access are explicit. I did not find evidence of network transmission from the script, so the concern is local exposure and scope, not exfiltration.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The post-migration flow can invoke skill-i18n with no prompt and overwrite options, and documentation generation can call a selected UI skill. This creates a supply-chain dependency on locally installed skills outside this package.
The external skill calls are documented and appear optional. Risk depends on which local skills are installed, so confidence is high for the pattern but lower for exploitability.
Generated Documentation Uses Configurable Domain And File Writes
The docs workflow writes or removes docs/CNAME based on configuration and updates files under the generated docs directory. This is expected for GitHub Pages, but it can publish links to a user-controlled domain and alter repository content.
The behavior is visible and scoped to docs output. It is moderate risk because a misleading custom domain or unreviewed generated files could be committed and pushed.
C2 Keyword Static Hits Are Documentation Style Text
The C2 keyword alerts align with design preset language, colors, and generated site examples rather than command-and-control behavior. I did not find evidence of malware callback logic in the reviewed lines.
The cited context is documentation about visual styles and output text. The static keyword match is weak, but broader network behavior still exists through git pushes.
Many static findings are repeated in SKILL.ja.md and SKILL.zh-CN.md because they are translations of the same workflow. The duplicates increase the count but do not add separate behavior.
The translated files mirror the command table and workflow sections. They matter for user-facing instructions, but they are not independent executable implementations.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Weak Cryptography Static Hits Are Mostly Cache-Busting Examples
The weak cryptography alerts include Markdown examples using md5 to create short cache-busting strings for docs assets. This is not used for password storage, signing, or security-sensitive cryptography.
The surrounding section states the purpose is browser cache versioning. That context makes the weak-crypto finding a low-risk false positive.