Versioned security assessment

Report ID: SA-C43861A6

7/23/2026, 1:06:26 PM

team-dev security assessment v3

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
team-dev
Version
v3
Maintainer
cubha
Source
github.com/cubha/claude-workflow-plugins/tree/3172e1a00f7090579f36af20c046828489983c23/plugins/team-dev/skills/team-dev
Coverage
4 Files scanned · 549 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Four command-execution findings are confirmed because the workflow runs repository-provided tests and verification scripts. Sixteen Markdown backtick findings and four entropy findings are false positives, but prompt propagation and automatic integration create additional security concerns.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 549 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 20 evidence locations

Capability review items (4)
Medium
phase-dispatch.md:59-69
Ruby/shell backtick execution
1. 미구현 동작에 대한 단위 테스트(`*.test.*`)를 먼저 작성 → 실행 → **RED 확인**
The cited range directs an agent to execute tests and then run a project verification script. Repository test and build commands can execute untrusted project code.
Medium
phase-dispatch.md:69
Ruby/shell backtick execution
4. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test`·`npm run build` 등). 없으면 정적 검증 단계를 생략한
The instruction explicitly runs bash verify.sh, npm test, or npm run build. These repository-controlled commands can execute arbitrary local scripts.
Medium
phase-dispatch.md:114
Ruby/shell backtick execution
5. 구현 완료 후 프로젝트 검증 스크립트가 있으면 실행하라 (`bash verify.sh`·`npm test` 등).
The team-mode prompt explicitly requires execution of repository verification commands. No inspection, sandboxing, or confirmation requirement is stated.
Medium
SKILL.md:23
Ruby/shell backtick execution
- **검증 스크립트(선택)** — `verify.sh`·`npm test`·`npm run build` 등 프로젝트 검증 수단이 있으면 각 SubTask 완료 후 및 통합 시 실
The line instructs the workflow to execute repository verification commands after subtasks and integration. Shell and package scripts can run untrusted project code.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
phase-analyze.md:85
Prompt Injection Attempt Detected
The prompt template states "CONSISTENCY LOCK — OVERRIDE DEFAULT VARIATION DIRECTIVES." It is placed at the top of another skill prompt and claims precedence over existing directives.
The source contains explicit override language and directs the orchestrator to inject it into a downstream prompt.
RISK-002 High
phase-analyze.md:34-36phase-dispatch.md:29-30
Untrusted Repository Instructions Propagated to Agents
The workflow reads project rule files such as CLAUDE.md and inserts their contents into subagent prompts without validation or a trust boundary.
Both collection and direct prompt insertion are explicitly documented, and no filtering or precedence defense is specified.
RISK-003 Medium
phase-verify.md:6-13
Automatic Integration of Agent-Generated Branches
The workflow merges agent branches into the main branch and may attempt conflict resolution before requesting user judgment.
The merge commands and automatic conflict-resolution sequence are explicit, creating a clear code-integrity risk without a mandatory review gate.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Project rule files are inserted into subagent prompts without a trust boundary.
    Treat repository instructions as untrusted data, reject precedence-changing directives, and pass only reviewed project facts to subagents.
  2. FIX-002
    High
    The design prompt explicitly tells another skill to override its default directives.
    Replace precedence language with scoped design requirements that cannot override system, security, or tool policies.
  3. FIX-003
    Medium
    Repository-provided test and verification commands can execute untrusted code.
    Inspect command definitions and require explicit user confirmation before execution, especially in auto mode. Run approved commands in a restricted environment.
  4. FIX-004
    Medium
    Agent branches are merged and conflicts may be edited without a dedicated review gate.
    Merge into a temporary integration branch, show the diff and verification results, and require approval before updating the main branch.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
c43861a65bb95efcae259cd161c9d6f4dc7eec6f
Content hash
01bbcbcde21c516111daae184c465881bec3bba20a22ac569c2510d2e715a701
Tree hash
d8f10e8151c1e89e8aa8c15155c66d8b70bb69dc602e300d731810b45e629b85
Skill path
skills/cubha/team-dev
Audit payload hash
1a2fe48b6244a712059566341f2349f1

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active