Skills team-dev Audit History
πŸ“¦

Audit History

team-dev - 3 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v3 LatestJul 23, 2026, 01:06 PM 3 confirmed4No capability change
v2 Jul 22, 2026, 12:39 AM No confirmed findings0No capability change
v1 Jul 22, 2026, 12:39 AM No confirmed findings0Baseline

Jul 23, 2026, 01:06 PM

Four command-execution findings are confirmed because the workflow runs repository-provided tests and verification scripts. Sixteen Markdown backtick findings and four entropy findings are false positives, but prompt propagation and automatic integration create additional security concerns.

4
Files scanned
549
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (3)

High
Prompt Injection Attempt Detected
The prompt template states "CONSISTENCY LOCK β€” OVERRIDE DEFAULT VARIATION DIRECTIVES." It is placed at the top of another skill prompt and claims precedence over existing directives.
The source contains explicit override language and directs the orchestrator to inject it into a downstream prompt.
High
Untrusted Repository Instructions Propagated to Agents
The workflow reads project rule files such as CLAUDE.md and inserts their contents into subagent prompts without validation or a trust boundary.
Both collection and direct prompt insertion are explicitly documented, and no filtering or precedence defense is specified.
Medium
Automatic Integration of Agent-Generated Branches
The workflow merges agent branches into the main branch and may attempt conflict resolution before requesting user judgment.
The merge commands and automatic conflict-resolution sequence are explicit, creating a clear code-integrity risk without a mandatory review gate.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
1. λ―Έκ΅¬ν˜„ λ™μž‘μ— λŒ€ν•œ λ‹¨μœ„ ν…ŒμŠ€νŠΈ(`*.test.*`)λ₯Ό λ¨Όμ € μž‘μ„± β†’ μ‹€ν–‰ β†’ **RED 확인**
The cited range directs an agent to execute tests and then run a project verification script. Repository test and build commands can execute untrusted project code.
Medium
Ruby/shell backtick execution
4. κ΅¬ν˜„ μ™„λ£Œ ν›„ ν”„λ‘œμ νŠΈ 검증 μŠ€ν¬λ¦½νŠΈκ°€ 있으면 μ‹€ν–‰ν•˜λΌ (`bash verify.sh`Β·`npm test`Β·`npm run build` λ“±). μ—†μœΌλ©΄ 정적 검증 단계λ₯Ό μƒλž΅ν•œ
The instruction explicitly runs bash verify.sh, npm test, or npm run build. These repository-controlled commands can execute arbitrary local scripts.
Medium
Ruby/shell backtick execution
5. κ΅¬ν˜„ μ™„λ£Œ ν›„ ν”„λ‘œμ νŠΈ 검증 μŠ€ν¬λ¦½νŠΈκ°€ 있으면 μ‹€ν–‰ν•˜λΌ (`bash verify.sh`Β·`npm test` λ“±).
The team-mode prompt explicitly requires execution of repository verification commands. No inspection, sandboxing, or confirmation requirement is stated.
Medium
Ruby/shell backtick execution
- **검증 슀크립트(선택)** β€” `verify.sh`Β·`npm test`Β·`npm run build` λ“± ν”„λ‘œμ νŠΈ 검증 μˆ˜λ‹¨μ΄ 있으면 각 SubTask μ™„λ£Œ ν›„ 및 톡합 μ‹œ μ‹€
The line instructs the workflow to execute repository verification commands after subtasks and integration. Shell and package scripts can run untrusted project code.
Audited by: codex

Jul 22, 2026, 12:39 AM

All 20 external-command detections are false positives caused by Markdown code spans or documentation of optional project verification commands. All four entropy alerts are false positives because the reviewed files are readable Markdown documentation; no encoded payloads, executable code, network access, secret collection, or prompt-injection attempt was found.

4
Files scanned
549
Lines analyzed
1
Review items
0
False positives ignored
Audited by: claude

Jul 22, 2026, 12:39 AM

All 20 external-command detections are false positives caused by Markdown code spans or documentation of optional project verification commands. All four entropy alerts are false positives because the reviewed files are readable Markdown documentation; no encoded payloads, executable code, network access, secret collection, or prompt-injection attempt was found.

4
Files scanned
549
Lines analyzed
1
Review items
0
False positives ignored
Audited by: claude