📦
Audit History
github-elements-tracking - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 5, 2026, 04:05 PM | 3 confirmed | 81 | No capability change |
| v8 | Jul 5, 2026, 04:05 PM | 3 confirmed | 81 | No capability change |
| v7 | Jun 29, 2026, 11:08 PM | 2 confirmed | 0 | External commandsEnv variablesNetwork access Contains scripts |
| v6 | Jan 23, 2026, 02:30 AM | No confirmed findings | 0 | Contains scripts External commandsNetwork access |
| v5 | Jan 17, 2026, 05:02 AM | No confirmed findings | 0 | No capability change |
| v4 | Jan 17, 2026, 05:02 AM | No confirmed findings | 0 | External commandsFilesystem accessNetwork access |
| v3 | Jan 10, 2026, 02:56 PM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 02:56 PM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 02:56 PM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 5, 2026, 04:05 PM
Most static hits are documentation artifacts, especially Markdown code spans, example links, and workflow prose. Confirmed risks remain because the skill directs agents to run shell and GitHub CLI commands, write parent worktree paths, modify hidden Claude configuration, install an external MCP package, and install GitHub automation with write permissions.
12
Files scanned
10,750
Lines analyzed
88
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Prompt Injection Attempt Detected
The skill states that its law is absolute and that every user word must be followed verbatim. This can pressure an assistant to treat skill text as higher priority than safety or security review.
The wording uses absolute authority language and directs verbatim obedience to user specifications. It does not explicitly say to ignore system instructions, so confidence is high but not maximal.
High
Unpinned Third-Party MCP Installation
The setup workflow tells users to install and run SERENA MCP from a GitHub URL through uvx and Claude MCP tooling. The dependency is not pinned to a reviewed commit in the cited commands.
The cited lines create an install script and run uvx from a git+https URL. That is a direct supply-chain risk even if the dependency is legitimate.
Medium
Repository Automation With Write Permissions
The enforcement guide includes GitHub Actions snippets with issue and pull-request write permissions. If installed, they can automatically comment, label, and request changes in repository workflows.
The cited workflow examples request write permissions and call GitHub APIs that mutate issues or pull requests. This is intended enforcement behavior, but it requires explicit repository-owner review.
Capability review items (81)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
claude mcp add serena -- uvx --from git+https://github.com/oraios/serena serena start-mcp-server --c
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project create $lang_flags
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project index
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Path traversal sequence
**Standard Worktree Location**: `../ghe-worktrees/issue-{N}/`
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
mkdir -p ../ghe-worktrees
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-${ISSUE_NUM} -b issue-${ISSUE_NUM} main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence · 2 occurrences
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "Create worktree: git worktree add ../ghe-worktrees/issue-N -b issue-N main"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "WARNING: Not in a worktree. Should be in ../ghe-worktrees/issue-N/"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| Claim DEV | `git worktree add ../ghe-worktrees/issue-N -b issue-N main` |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| `GHE_WORKTREES_DIR` | ../ghe-worktrees | Worktrees directory |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence · 2 occurrences
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
if ! verify_worktree_health "../ghe-worktrees/issue-123"; then
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-123 -b issue-123 main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| **Work on main branch** | Breaks isolation, pollutes main | ALL work in worktrees: `../ghe-worktre
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Medium
references/P1-task-agent-playbook.md:206references/P1-task-agent-playbook.md:247references/P1-task-agent-playbook.md:406references/P1-task-agent-playbook.md:547
Shell command substitution · 4 occurrences
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BODY=$(gh issue view $ISSUE --json body --jq '.body')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
Started: $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
SUB_ISSUE=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[].name | select(startswith("epic:")
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/updated_body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue view $ISSUE --json body --jq '.body' > /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
# Edit /tmp/body.md to check completed task boxes, add links
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
references/P2-epic-coordinator-playbook.md:200-217references/P2-epic-coordinator-playbook.md:338-368references/P2-epic-coordinator-playbook.md:532-540references/P2-epic-coordinator-playbook.md:562-570references/P8-complete-lifecycle-example.md:306-324references/P8-complete-lifecycle-example.md:497-515
Shell command substitution · 6 occurrences
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $REVIEW_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
DEV_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:dev" --state open --json number --jq 'l
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state open --json number --jq
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_ISSUE=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state closed --json number --
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Started - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P3-review-agent-playbook.md:206references/P3-review-agent-playbook.md:377references/P5-multi-instance-protocol.md:364
Shell command substitution · 3 occurrences
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Progress - $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Re-Review - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P4-compaction-recovery-walkthrough.md:413-417references/P8-complete-lifecycle-example.md:628-632
Shell command substitution · 2 occurrences
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
ASSIGNEE=$(gh issue view $ISSUE --json assignees --jq '.assignees[0].login')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
LABELS=$(gh issue view $ISSUE --json labels --jq '.labels[].name')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $TEST_ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P9-test-agent-playbook.md:134-135references/P9-test-agent-playbook.md:176-177references/P9-test-agent-playbook.md:321-330references/P9-test-agent-playbook.md:392-393
Shell command substitution · 4 occurrences
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session 1] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $DEV_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session N - COMPLETE] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
PROJECT_DIR=$(pwd)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BRANCH=$(git branch --show-current)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
REVIEW_DATE=$(date +%Y-%m-%d)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
BEHIND=$(git rev-list --count HEAD..origin/main)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
attempt=$((attempt + 1))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local start=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
while [ $(check_merge_lock) -gt 0 ]; do
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local now=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local elapsed=$((now - start))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh pr edit 456 --body "$(gh pr view 456 --json body --jq .body)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Template literal with command substitution · 6 occurrences
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Unix shell invocation · 2 occurrences
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Medium
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Risk Factors
⚙️ External commands (442)
references/P1-task-agent-playbook.md:141-142 references/P1-task-agent-playbook.md:142-149 references/P1-task-agent-playbook.md:445-452 references/P1-task-agent-playbook.md:584-596 references/P1-task-agent-playbook.md:206 references/P1-task-agent-playbook.md:237 references/P1-task-agent-playbook.md:247 references/P1-task-agent-playbook.md:280 references/P1-task-agent-playbook.md:364 references/P1-task-agent-playbook.md:406 references/P1-task-agent-playbook.md:547 references/P1-task-agent-playbook.md:645 references/P1-task-agent-playbook.md:664 references/P10-bug-triage-protocol.md:100-103 references/P2-epic-coordinator-playbook.md:200-217 references/P2-epic-coordinator-playbook.md:240 references/P2-epic-coordinator-playbook.md:338-368 references/P2-epic-coordinator-playbook.md:532-540 references/P2-epic-coordinator-playbook.md:562-570 references/P3-review-agent-playbook.md:262-270 references/P3-review-agent-playbook.md:99 references/P3-review-agent-playbook.md:102 references/P3-review-agent-playbook.md:110 references/P3-review-agent-playbook.md:118 references/P3-review-agent-playbook.md:180-181 references/P3-review-agent-playbook.md:181 references/P3-review-agent-playbook.md:206 references/P3-review-agent-playbook.md:221 references/P3-review-agent-playbook.md:377 references/P3-review-agent-playbook.md:391 references/P4-compaction-recovery-walkthrough.md:142-149 references/P4-compaction-recovery-walkthrough.md:194-201 references/P4-compaction-recovery-walkthrough.md:306-319 references/P4-compaction-recovery-walkthrough.md:364-368 references/P4-compaction-recovery-walkthrough.md:430-444 references/P4-compaction-recovery-walkthrough.md:644-645 references/P4-compaction-recovery-walkthrough.md:645-663 references/P4-compaction-recovery-walkthrough.md:663-673 references/P4-compaction-recovery-walkthrough.md:714-729 references/P4-compaction-recovery-walkthrough.md:800-810 references/P4-compaction-recovery-walkthrough.md:413-417 references/P5-multi-instance-protocol.md:164-180 references/P5-multi-instance-protocol.md:331-344 references/P5-multi-instance-protocol.md:93 references/P5-multi-instance-protocol.md:102 references/P5-multi-instance-protocol.md:317 references/P5-multi-instance-protocol.md:364 references/P6-enforcement-setup.md:112 references/P6-enforcement-setup.md:116-135 references/P6-enforcement-setup.md:138 references/P6-enforcement-setup.md:140-154 references/P6-enforcement-setup.md:159 references/P6-enforcement-setup.md:167 references/P6-enforcement-setup.md:171-173 references/P6-enforcement-setup.md:227-270 references/P6-enforcement-setup.md:270-278 references/P6-enforcement-setup.md:286-295 references/P6-enforcement-setup.md:301-305 references/P6-enforcement-setup.md:345-370 references/P6-enforcement-setup.md:374-378 references/P6-enforcement-setup.md:378-430 references/P6-enforcement-setup.md:430-438 references/P6-enforcement-setup.md:444-447 references/P6-enforcement-setup.md:486 references/P6-enforcement-setup.md:489 references/P6-enforcement-setup.md:499 references/P6-enforcement-setup.md:501-504 references/P6-enforcement-setup.md:572-575 references/P6-enforcement-setup.md:652-659 references/P6-enforcement-setup.md:682-685 references/P6-enforcement-setup.md:748 references/P6-enforcement-setup.md:750 references/P6-enforcement-setup.md:753 references/P6-enforcement-setup.md:755 references/P6-enforcement-setup.md:757-760 references/P6-enforcement-setup.md:817-820 references/P7-validation-checklist.md:838-839 references/P7-validation-checklist.md:839-846 references/P8-complete-lifecycle-example.md:76-108 references/P8-complete-lifecycle-example.md:199-209 references/P8-complete-lifecycle-example.md:277-288 references/P8-complete-lifecycle-example.md:311-325 references/P8-complete-lifecycle-example.md:325-345 references/P8-complete-lifecycle-example.md:400-409 references/P8-complete-lifecycle-example.md:423-427 references/P8-complete-lifecycle-example.md:502-517 references/P8-complete-lifecycle-example.md:517-533 references/P8-complete-lifecycle-example.md:836-837 references/P8-complete-lifecycle-example.md:837-847 references/P8-complete-lifecycle-example.md:306-324 references/P8-complete-lifecycle-example.md:497-515 references/P8-complete-lifecycle-example.md:628-632 references/P9-test-agent-playbook.md:217-218 references/P9-test-agent-playbook.md:218-223 references/P9-test-agent-playbook.md:271-274 references/P9-test-agent-playbook.md:292-296 references/P9-test-agent-playbook.md:476-484 references/P9-test-agent-playbook.md:121 references/P9-test-agent-playbook.md:134-135 references/P9-test-agent-playbook.md:135 references/P9-test-agent-playbook.md:176-177 references/P9-test-agent-playbook.md:321-330 references/P9-test-agent-playbook.md:362-372 references/P9-test-agent-playbook.md:392-393 references/P9-test-agent-playbook.md:393 references/templates/issue-comment-format.md:52-53 references/templates/issue-comment-format.md:83-84 references/templates/issue-comment-format.md:84-89 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:62 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:127-133 SKILL.md:133-186 SKILL.md:186-194 SKILL.md:194 SKILL.md:204 SKILL.md:205 SKILL.md:206 SKILL.md:207 SKILL.md:210 SKILL.md:234-261 SKILL.md:261-267 SKILL.md:267-287 SKILL.md:287-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322-334 SKILL.md:334 SKILL.md:335-336 SKILL.md:336 SKILL.md:346-348 SKILL.md:348-392 SKILL.md:392-395 SKILL.md:395-400 SKILL.md:400-405 SKILL.md:405-407 SKILL.md:407-411 SKILL.md:411-420 SKILL.md:420-433 SKILL.md:433-437 SKILL.md:437-440 SKILL.md:440-447 SKILL.md:447-451 SKILL.md:451-453 SKILL.md:453-467 SKILL.md:467-473 SKILL.md:473-490 SKILL.md:490-494 SKILL.md:494-512 SKILL.md:512-518 SKILL.md:518 SKILL.md:519 SKILL.md:520 SKILL.md:525-537 SKILL.md:537-540 SKILL.md:540-552 SKILL.md:552-555 SKILL.md:555-564 SKILL.md:564-570 SKILL.md:570-573 SKILL.md:573-574 SKILL.md:574-580 SKILL.md:580-591 SKILL.md:591-599 SKILL.md:599-607 SKILL.md:607-614 SKILL.md:614-618 SKILL.md:618-620 SKILL.md:620-622 SKILL.md:622-626 SKILL.md:626-671 SKILL.md:671-677 SKILL.md:677-697 SKILL.md:697-737 SKILL.md:737-753 SKILL.md:753-755 SKILL.md:755-765 SKILL.md:765-818 SKILL.md:818-824 SKILL.md:824-861 SKILL.md:861-892 SKILL.md:892-894 SKILL.md:894-896 SKILL.md:896-929 SKILL.md:929-935 SKILL.md:935-961 SKILL.md:961-970 SKILL.md:970-976 SKILL.md:976-996 SKILL.md:996-1000 SKILL.md:1000-1001 SKILL.md:1001-1002 SKILL.md:1002-1003 SKILL.md:1003-1004 SKILL.md:1004-1005 SKILL.md:1005-1012 SKILL.md:1012-1043 SKILL.md:1043 SKILL.md:1044-1045 SKILL.md:1045-1049 SKILL.md:1049-1071 SKILL.md:1071-1078 SKILL.md:1078-1088 SKILL.md:1088-1089 SKILL.md:1089-1090 SKILL.md:1090-1094 SKILL.md:1094-1097 SKILL.md:1097-1103 SKILL.md:1103-1128 SKILL.md:1128-1134 SKILL.md:1134-1135 SKILL.md:1135-1136 SKILL.md:1136-1137 SKILL.md:1137-1138 SKILL.md:1138 SKILL.md:1139-1140 SKILL.md:1140 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143-1159 SKILL.md:1159-1160 SKILL.md:1160-1161 SKILL.md:1161 SKILL.md:1162-1163 SKILL.md:1163-1164 SKILL.md:1164-1169 SKILL.md:1169-1180 SKILL.md:1180-1185 SKILL.md:1185-1190 SKILL.md:1190-1209 SKILL.md:1209-1212 SKILL.md:1212-1240 SKILL.md:1240-1243 SKILL.md:1243-1279 SKILL.md:1279-1282 SKILL.md:1282-1299 SKILL.md:1299-1302 SKILL.md:1302-1335 SKILL.md:1335-1343 SKILL.md:1343-1344 SKILL.md:1344-1345 SKILL.md:1345-1346 SKILL.md:1346-1347 SKILL.md:1347 SKILL.md:1348-1349 SKILL.md:1349-1350 SKILL.md:1350-1357 SKILL.md:1357-1360 SKILL.md:1360-1363 SKILL.md:1363 SKILL.md:1364 SKILL.md:1365 SKILL.md:1368-1372 SKILL.md:1372-1384 SKILL.md:1384-1385 SKILL.md:1385-1386 SKILL.md:1386-1387 SKILL.md:1387-1388 SKILL.md:1388-1394 SKILL.md:1394-1395 SKILL.md:1395-1396 SKILL.md:1396-1397 SKILL.md:1397-1403 SKILL.md:1403-1404 SKILL.md:1404-1405 SKILL.md:1405-1406 SKILL.md:1406-1407 SKILL.md:1407 SKILL.md:1408-1414 SKILL.md:1414-1415 SKILL.md:1415-1416 SKILL.md:1416-1422 SKILL.md:1422-1423 SKILL.md:1423-1424 SKILL.md:1424-1425 SKILL.md:1425-1426 SKILL.md:1426-1427 SKILL.md:1427-1428 SKILL.md:1428-1434 SKILL.md:1434-1435 SKILL.md:1435 SKILL.md:1441-1479 SKILL.md:1479-1485 SKILL.md:1485-1539 SKILL.md:1539-1597 SKILL.md:1597-1614 SKILL.md:1614-1635 SKILL.md:1635-1648 SKILL.md:1648-1654 SKILL.md:1654-1660 SKILL.md:1660-1661 SKILL.md:1661-1662 SKILL.md:1662-1666 SKILL.md:1666-1692 SKILL.md:1692-1698 SKILL.md:1698-1699 SKILL.md:1699-1700 SKILL.md:1700-1701 SKILL.md:1701-1702 SKILL.md:1702-1703 SKILL.md:1703-1709 SKILL.md:1709-1713 SKILL.md:1713-1721 SKILL.md:1721-1726 SKILL.md:1726-1727 SKILL.md:1727-1734 SKILL.md:1734-1753 SKILL.md:1753-1759 SKILL.md:1759-1775 SKILL.md:1775-1812 SKILL.md:1812-1820 SKILL.md:1820-1841 SKILL.md:1841-1843 SKILL.md:1843-1875 SKILL.md:1875-1883 SKILL.md:1883-1884 SKILL.md:1884-1885 SKILL.md:1885-1888 SKILL.md:1888-1895 SKILL.md:1895-1905 SKILL.md:1905-1912 SKILL.md:1912-1918 SKILL.md:1918-1919 SKILL.md:1919-1920 SKILL.md:1920-1926 SKILL.md:1926-1932 SKILL.md:1932-1961 SKILL.md:1961-1972 SKILL.md:1972-1984 SKILL.md:1984-1985 SKILL.md:1985-1986 SKILL.md:1986-1987 SKILL.md:1987-1988 SKILL.md:1988-1989 SKILL.md:1989-1990 SKILL.md:1990-1996 SKILL.md:1996-1997 SKILL.md:1997-1998 SKILL.md:1998-2004 SKILL.md:2004-2005 SKILL.md:2005-2006 SKILL.md:2006-2007 SKILL.md:2007-2021 SKILL.md:2021-2033 SKILL.md:2033-2039 SKILL.md:2039-2040 SKILL.md:2040-2041 SKILL.md:2041-2042 SKILL.md:2042-2043 SKILL.md:2043-2044 SKILL.md:2044-2045 SKILL.md:2045-2046 SKILL.md:2046-2047 SKILL.md:2047-2048 SKILL.md:2048-2049 SKILL.md:2049-2050 SKILL.md:2050-2051 SKILL.md:2051 SKILL.md:2052-2058 SKILL.md:2058-2061 SKILL.md:2061-2083 SKILL.md:2083-2086 SKILL.md:2086-2092 SKILL.md:2092-2093 SKILL.md:2093-2094 SKILL.md:2094-2095 SKILL.md:2095-2096 SKILL.md:2096-2097 SKILL.md:2097-2098 SKILL.md:2098-2099 SKILL.md:2099-2100 SKILL.md:2100-2101 SKILL.md:2101-2102 SKILL.md:2102-2108 SKILL.md:2108-2109 SKILL.md:2109-2110 SKILL.md:2110-2111 SKILL.md:2111-2115 SKILL.md:2115-2126 SKILL.md:2126-2136 SKILL.md:2136-2146 SKILL.md:2146-2152 SKILL.md:2152-2160 SKILL.md:2160-2166 SKILL.md:2166-2171 SKILL.md:2171-2177 SKILL.md:2177-2190 SKILL.md:2190-2196 SKILL.md:2196-2201 SKILL.md:2201-2207 SKILL.md:2207 SKILL.md:2208-2209 SKILL.md:2209-2210 SKILL.md:2210-2211 SKILL.md:2211-2212 SKILL.md:2212-2218 SKILL.md:2218-2226 SKILL.md:2226-2262 SKILL.md:2262-2265 SKILL.md:2265-2267 SKILL.md:2267-2269 SKILL.md:2269-2517 SKILL.md:2517-2527 SKILL.md:2527-2530 SKILL.md:2530-2534 SKILL.md:2534-2544 SKILL.md:2544-2546 SKILL.md:2546-2561 SKILL.md:2561-2568 SKILL.md:2568-2585 SKILL.md:2585-2586 SKILL.md:2586-2587 SKILL.md:2587-2588 SKILL.md:2588-2589 SKILL.md:353 SKILL.md:475 SKILL.md:699 SKILL.md:775 SKILL.md:805 SKILL.md:833 SKILL.md:835 SKILL.md:836 SKILL.md:837 SKILL.md:1872 SKILL.md:348-392 SKILL.md:473-490 SKILL.md:697-737 SKILL.md:765-818 SKILL.md:824-861 SKILL.md:1843-1875 SKILL.md:349 SKILL.md:1442
📁 Filesystem access (59)
references/P1-task-agent-playbook.md:283 references/P1-task-agent-playbook.md:458 references/P1-task-agent-playbook.md:459 references/P1-task-agent-playbook.md:460 references/P5-multi-instance-protocol.md:870 references/P6-enforcement-setup.md:116 references/P6-enforcement-setup.md:171 references/P6-enforcement-setup.md:286 references/P6-enforcement-setup.md:38 references/P6-enforcement-setup.md:39 references/P6-enforcement-setup.md:40 references/P6-enforcement-setup.md:41 references/P6-enforcement-setup.md:42 references/P6-enforcement-setup.md:48 references/P6-enforcement-setup.md:49 references/P6-enforcement-setup.md:50 references/P6-enforcement-setup.md:51 references/P6-enforcement-setup.md:52 references/P6-enforcement-setup.md:53 references/P6-enforcement-setup.md:56 references/P6-enforcement-setup.md:57 references/P6-enforcement-setup.md:58 references/P6-enforcement-setup.md:59 references/P6-enforcement-setup.md:63 references/P6-enforcement-setup.md:65 references/P6-enforcement-setup.md:66 references/templates/issue-comment-format.md:10 references/templates/issue-comment-format.md:11 references/templates/issue-comment-format.md:12 references/templates/issue-comment-format.md:13 references/templates/issue-comment-format.md:14 references/templates/issue-comment-format.md:15 references/templates/issue-comment-format.md:16 references/templates/issue-comment-format.md:17 references/templates/issue-comment-format.md:18 references/templates/issue-comment-format.md:19 references/templates/issue-comment-format.md:20 references/templates/issue-comment-format.md:58 references/templates/issue-comment-format.md:73 SKILL.md:451 SKILL.md:457 SKILL.md:460 SKILL.md:463 SKILL.md:480 SKILL.md:486 SKILL.md:570 SKILL.md:702 SKILL.md:2060 SKILL.md:2111 SKILL.md:2159 SKILL.md:2181 SKILL.md:2185 SKILL.md:2188 SKILL.md:2262 SKILL.md:26 SKILL.md:26 SKILL.md:589 SKILL.md:1454 SKILL.md:1458
🔑 Env variables (14)
references/P2-epic-coordinator-playbook.md:416 references/P4-compaction-recovery-walkthrough.md:213 references/P4-compaction-recovery-walkthrough.md:225 references/P4-compaction-recovery-walkthrough.md:230 references/P4-compaction-recovery-walkthrough.md:232 references/P4-compaction-recovery-walkthrough.md:243 references/P4-compaction-recovery-walkthrough.md:251 references/P4-compaction-recovery-walkthrough.md:295 references/P4-compaction-recovery-walkthrough.md:314 references/P4-compaction-recovery-walkthrough.md:450 references/P5-multi-instance-protocol.md:257 references/P5-multi-instance-protocol.md:265 references/P5-multi-instance-protocol.md:282 references/P5-multi-instance-protocol.md:297
🌐 Network access (4)
Audited by: codex
Jul 5, 2026, 04:05 PM
Most static hits are documentation artifacts, especially Markdown code spans, example links, and workflow prose. Confirmed risks remain because the skill directs agents to run shell and GitHub CLI commands, write parent worktree paths, modify hidden Claude configuration, install an external MCP package, and install GitHub automation with write permissions.
12
Files scanned
10,750
Lines analyzed
88
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Prompt Injection Attempt Detected
The skill states that its law is absolute and that every user word must be followed verbatim. This can pressure an assistant to treat skill text as higher priority than safety or security review.
The wording uses absolute authority language and directs verbatim obedience to user specifications. It does not explicitly say to ignore system instructions, so confidence is high but not maximal.
High
Unpinned Third-Party MCP Installation
The setup workflow tells users to install and run SERENA MCP from a GitHub URL through uvx and Claude MCP tooling. The dependency is not pinned to a reviewed commit in the cited commands.
The cited lines create an install script and run uvx from a git+https URL. That is a direct supply-chain risk even if the dependency is legitimate.
Medium
Repository Automation With Write Permissions
The enforcement guide includes GitHub Actions snippets with issue and pull-request write permissions. If installed, they can automatically comment, label, and request changes in repository workflows.
The cited workflow examples request write permissions and call GitHub APIs that mutate issues or pull requests. This is intended enforcement behavior, but it requires explicit repository-owner review.
Capability review items (81)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
claude mcp add serena -- uvx --from git+https://github.com/oraios/serena serena start-mcp-server --c
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project create $lang_flags
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Hardcoded URL
uvx --from git+https://github.com/oraios/serena serena project index
The setup script pulls or runs SERENA MCP from a GitHub URL through uvx or Claude MCP tooling. This is an intended dependency install, but it executes code from an external source.
High
Path traversal sequence
**Standard Worktree Location**: `../ghe-worktrees/issue-{N}/`
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
mkdir -p ../ghe-worktrees
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-${ISSUE_NUM} -b issue-${ISSUE_NUM} main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence · 2 occurrences
cd ../ghe-worktrees/issue-${ISSUE_NUM}
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "Create worktree: git worktree add ../ghe-worktrees/issue-N -b issue-N main"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
echo "WARNING: Not in a worktree. Should be in ../ghe-worktrees/issue-N/"
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| Claim DEV | `git worktree add ../ghe-worktrees/issue-N -b issue-N main` |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| `GHE_WORKTREES_DIR` | ../ghe-worktrees | Worktrees directory |
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence · 2 occurrences
safe_worktree_cleanup "../ghe-worktrees/issue-123" true
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
if ! verify_worktree_health "../ghe-worktrees/issue-123"; then
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
git worktree add ../ghe-worktrees/issue-123 -b issue-123 main
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Path traversal sequence
| **Work on main branch** | Breaks isolation, pollutes main | ALL work in worktrees: `../ghe-worktre
The guidance creates, enters, or removes ../ghe-worktrees paths outside the immediate project directory. That parent-directory access is intentional for worktrees, but it is a real filesystem boundary risk.
High
Hidden file in home directory
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Medium
references/P1-task-agent-playbook.md:206references/P1-task-agent-playbook.md:247references/P1-task-agent-playbook.md:406references/P1-task-agent-playbook.md:547
Shell command substitution · 4 occurrences
TIMESTAMP="$(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BODY=$(gh issue view $ISSUE --json body --jq '.body')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
Started: $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
SUB_ISSUE=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[].name | select(startswith("epic:")
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/updated_body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue view $ISSUE --json body --jq '.body' > /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
# Edit /tmp/body.md to check completed task boxes, add links
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
Temp directory access
gh issue edit $ISSUE --body-file /tmp/body.md
The skill instructs agents to write or edit temporary files under /tmp before updating GitHub Issues. This is a real filesystem side effect, although the intended use is transient issue-body editing.
Medium
references/P2-epic-coordinator-playbook.md:200-217references/P2-epic-coordinator-playbook.md:338-368references/P2-epic-coordinator-playbook.md:532-540references/P2-epic-coordinator-playbook.md:562-570references/P8-complete-lifecycle-example.md:306-324references/P8-complete-lifecycle-example.md:497-515
Shell command substitution · 6 occurrences
--body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue list --limit 1 --json number --jq '.[0].number')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC=$(gh issue view $REVIEW_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:"
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
DEV_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:dev" --state open --json number --jq 'l
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_OPEN=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state open --json number --jq
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
TEST_ISSUE=$(gh issue list --label "epic:$EPIC" --label "phase:test" --state closed --json number --
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Started - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P3-review-agent-playbook.md:206references/P3-review-agent-playbook.md:377references/P5-multi-instance-protocol.md:364
Shell command substitution · 3 occurrences
EPIC=$(gh issue view $ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic:")) | .n
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Review Progress - $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## Re-Review - $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P4-compaction-recovery-walkthrough.md:413-417references/P8-complete-lifecycle-example.md:628-632
Shell command substitution · 2 occurrences
$ gh issue comment 201 --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
ASSIGNEE=$(gh issue view $ISSUE --json assignees --jq '.assignees[0].login')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
LABELS=$(gh issue view $ISSUE --json labels --jq '.labels[].name')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
EPIC_LABEL=$(gh issue view $MY_ISSUE --json labels --jq '.labels[] | select(.name | startswith("epic
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT=$(gh issue view $TEST_ISSUE --json assignees --jq '.assignees | length')
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
references/P9-test-agent-playbook.md:134-135references/P9-test-agent-playbook.md:176-177references/P9-test-agent-playbook.md:321-330references/P9-test-agent-playbook.md:392-393
Shell command substitution · 4 occurrences
gh issue comment $TEST_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session 1] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh issue comment $DEV_ISSUE --body "$(cat <<'EOF'
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
## [TEST Session N - COMPLETE] $(date -u +%Y-%m-%d) $(date -u +%H:%M) UTC - @me
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
PROJECT_DIR=$(pwd)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
CURRENT_BRANCH=$(git branch --show-current)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
REVIEW_DATE=$(date +%Y-%m-%d)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
BEHIND=$(git rev-list --count HEAD..origin/main)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
attempt=$((attempt + 1))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local start=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
while [ $(check_merge_lock) -gt 0 ]; do
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local now=$(date +%s)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
local elapsed=$((now - start))
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Shell command substitution
gh pr edit 456 --body "$(gh pr view 456 --json body --jq .body)
The skill documents shell command substitution inside commands that agents may run with gh, git, jq, or date. This is intended workflow behavior, but it still executes local shell logic with repository or GitHub side effects.
Medium
Template literal with command substitution · 6 occurrences
```bash
The flagged location opens a bash command block that includes variable expansion and operational commands. The exact label is broad, but the surrounding guidance still asks agents to execute shell workflows.
Medium
Unix shell invocation · 2 occurrences
#!/bin/bash
The finding is a bash script entry point in setup or verification guidance. Running it can execute local commands and modify tool configuration or repository state.
Medium
Hidden file access
- ~/.claude (for plugin/settings fixes)
The skill explicitly allows background agents to write under ~/.claude for plugin or settings fixes. Writing hidden user configuration is a real security-sensitive filesystem action.
Risk Factors
⚙️ External commands (442)
references/P1-task-agent-playbook.md:141-142 references/P1-task-agent-playbook.md:142-149 references/P1-task-agent-playbook.md:445-452 references/P1-task-agent-playbook.md:584-596 references/P1-task-agent-playbook.md:206 references/P1-task-agent-playbook.md:237 references/P1-task-agent-playbook.md:247 references/P1-task-agent-playbook.md:280 references/P1-task-agent-playbook.md:364 references/P1-task-agent-playbook.md:406 references/P1-task-agent-playbook.md:547 references/P1-task-agent-playbook.md:645 references/P1-task-agent-playbook.md:664 references/P10-bug-triage-protocol.md:100-103 references/P2-epic-coordinator-playbook.md:200-217 references/P2-epic-coordinator-playbook.md:240 references/P2-epic-coordinator-playbook.md:338-368 references/P2-epic-coordinator-playbook.md:532-540 references/P2-epic-coordinator-playbook.md:562-570 references/P3-review-agent-playbook.md:262-270 references/P3-review-agent-playbook.md:99 references/P3-review-agent-playbook.md:102 references/P3-review-agent-playbook.md:110 references/P3-review-agent-playbook.md:118 references/P3-review-agent-playbook.md:180-181 references/P3-review-agent-playbook.md:181 references/P3-review-agent-playbook.md:206 references/P3-review-agent-playbook.md:221 references/P3-review-agent-playbook.md:377 references/P3-review-agent-playbook.md:391 references/P4-compaction-recovery-walkthrough.md:142-149 references/P4-compaction-recovery-walkthrough.md:194-201 references/P4-compaction-recovery-walkthrough.md:306-319 references/P4-compaction-recovery-walkthrough.md:364-368 references/P4-compaction-recovery-walkthrough.md:430-444 references/P4-compaction-recovery-walkthrough.md:644-645 references/P4-compaction-recovery-walkthrough.md:645-663 references/P4-compaction-recovery-walkthrough.md:663-673 references/P4-compaction-recovery-walkthrough.md:714-729 references/P4-compaction-recovery-walkthrough.md:800-810 references/P4-compaction-recovery-walkthrough.md:413-417 references/P5-multi-instance-protocol.md:164-180 references/P5-multi-instance-protocol.md:331-344 references/P5-multi-instance-protocol.md:93 references/P5-multi-instance-protocol.md:102 references/P5-multi-instance-protocol.md:317 references/P5-multi-instance-protocol.md:364 references/P6-enforcement-setup.md:112 references/P6-enforcement-setup.md:116-135 references/P6-enforcement-setup.md:138 references/P6-enforcement-setup.md:140-154 references/P6-enforcement-setup.md:159 references/P6-enforcement-setup.md:167 references/P6-enforcement-setup.md:171-173 references/P6-enforcement-setup.md:227-270 references/P6-enforcement-setup.md:270-278 references/P6-enforcement-setup.md:286-295 references/P6-enforcement-setup.md:301-305 references/P6-enforcement-setup.md:345-370 references/P6-enforcement-setup.md:374-378 references/P6-enforcement-setup.md:378-430 references/P6-enforcement-setup.md:430-438 references/P6-enforcement-setup.md:444-447 references/P6-enforcement-setup.md:486 references/P6-enforcement-setup.md:489 references/P6-enforcement-setup.md:499 references/P6-enforcement-setup.md:501-504 references/P6-enforcement-setup.md:572-575 references/P6-enforcement-setup.md:652-659 references/P6-enforcement-setup.md:682-685 references/P6-enforcement-setup.md:748 references/P6-enforcement-setup.md:750 references/P6-enforcement-setup.md:753 references/P6-enforcement-setup.md:755 references/P6-enforcement-setup.md:757-760 references/P6-enforcement-setup.md:817-820 references/P7-validation-checklist.md:838-839 references/P7-validation-checklist.md:839-846 references/P8-complete-lifecycle-example.md:76-108 references/P8-complete-lifecycle-example.md:199-209 references/P8-complete-lifecycle-example.md:277-288 references/P8-complete-lifecycle-example.md:311-325 references/P8-complete-lifecycle-example.md:325-345 references/P8-complete-lifecycle-example.md:400-409 references/P8-complete-lifecycle-example.md:423-427 references/P8-complete-lifecycle-example.md:502-517 references/P8-complete-lifecycle-example.md:517-533 references/P8-complete-lifecycle-example.md:836-837 references/P8-complete-lifecycle-example.md:837-847 references/P8-complete-lifecycle-example.md:306-324 references/P8-complete-lifecycle-example.md:497-515 references/P8-complete-lifecycle-example.md:628-632 references/P9-test-agent-playbook.md:217-218 references/P9-test-agent-playbook.md:218-223 references/P9-test-agent-playbook.md:271-274 references/P9-test-agent-playbook.md:292-296 references/P9-test-agent-playbook.md:476-484 references/P9-test-agent-playbook.md:121 references/P9-test-agent-playbook.md:134-135 references/P9-test-agent-playbook.md:135 references/P9-test-agent-playbook.md:176-177 references/P9-test-agent-playbook.md:321-330 references/P9-test-agent-playbook.md:362-372 references/P9-test-agent-playbook.md:392-393 references/P9-test-agent-playbook.md:393 references/templates/issue-comment-format.md:52-53 references/templates/issue-comment-format.md:83-84 references/templates/issue-comment-format.md:84-89 SKILL.md:40 SKILL.md:41 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:62 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:127-133 SKILL.md:133-186 SKILL.md:186-194 SKILL.md:194 SKILL.md:204 SKILL.md:205 SKILL.md:206 SKILL.md:207 SKILL.md:210 SKILL.md:234-261 SKILL.md:261-267 SKILL.md:267-287 SKILL.md:287-307 SKILL.md:307-310 SKILL.md:310-322 SKILL.md:322-334 SKILL.md:334 SKILL.md:335-336 SKILL.md:336 SKILL.md:346-348 SKILL.md:348-392 SKILL.md:392-395 SKILL.md:395-400 SKILL.md:400-405 SKILL.md:405-407 SKILL.md:407-411 SKILL.md:411-420 SKILL.md:420-433 SKILL.md:433-437 SKILL.md:437-440 SKILL.md:440-447 SKILL.md:447-451 SKILL.md:451-453 SKILL.md:453-467 SKILL.md:467-473 SKILL.md:473-490 SKILL.md:490-494 SKILL.md:494-512 SKILL.md:512-518 SKILL.md:518 SKILL.md:519 SKILL.md:520 SKILL.md:525-537 SKILL.md:537-540 SKILL.md:540-552 SKILL.md:552-555 SKILL.md:555-564 SKILL.md:564-570 SKILL.md:570-573 SKILL.md:573-574 SKILL.md:574-580 SKILL.md:580-591 SKILL.md:591-599 SKILL.md:599-607 SKILL.md:607-614 SKILL.md:614-618 SKILL.md:618-620 SKILL.md:620-622 SKILL.md:622-626 SKILL.md:626-671 SKILL.md:671-677 SKILL.md:677-697 SKILL.md:697-737 SKILL.md:737-753 SKILL.md:753-755 SKILL.md:755-765 SKILL.md:765-818 SKILL.md:818-824 SKILL.md:824-861 SKILL.md:861-892 SKILL.md:892-894 SKILL.md:894-896 SKILL.md:896-929 SKILL.md:929-935 SKILL.md:935-961 SKILL.md:961-970 SKILL.md:970-976 SKILL.md:976-996 SKILL.md:996-1000 SKILL.md:1000-1001 SKILL.md:1001-1002 SKILL.md:1002-1003 SKILL.md:1003-1004 SKILL.md:1004-1005 SKILL.md:1005-1012 SKILL.md:1012-1043 SKILL.md:1043 SKILL.md:1044-1045 SKILL.md:1045-1049 SKILL.md:1049-1071 SKILL.md:1071-1078 SKILL.md:1078-1088 SKILL.md:1088-1089 SKILL.md:1089-1090 SKILL.md:1090-1094 SKILL.md:1094-1097 SKILL.md:1097-1103 SKILL.md:1103-1128 SKILL.md:1128-1134 SKILL.md:1134-1135 SKILL.md:1135-1136 SKILL.md:1136-1137 SKILL.md:1137-1138 SKILL.md:1138 SKILL.md:1139-1140 SKILL.md:1140 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143-1159 SKILL.md:1159-1160 SKILL.md:1160-1161 SKILL.md:1161 SKILL.md:1162-1163 SKILL.md:1163-1164 SKILL.md:1164-1169 SKILL.md:1169-1180 SKILL.md:1180-1185 SKILL.md:1185-1190 SKILL.md:1190-1209 SKILL.md:1209-1212 SKILL.md:1212-1240 SKILL.md:1240-1243 SKILL.md:1243-1279 SKILL.md:1279-1282 SKILL.md:1282-1299 SKILL.md:1299-1302 SKILL.md:1302-1335 SKILL.md:1335-1343 SKILL.md:1343-1344 SKILL.md:1344-1345 SKILL.md:1345-1346 SKILL.md:1346-1347 SKILL.md:1347 SKILL.md:1348-1349 SKILL.md:1349-1350 SKILL.md:1350-1357 SKILL.md:1357-1360 SKILL.md:1360-1363 SKILL.md:1363 SKILL.md:1364 SKILL.md:1365 SKILL.md:1368-1372 SKILL.md:1372-1384 SKILL.md:1384-1385 SKILL.md:1385-1386 SKILL.md:1386-1387 SKILL.md:1387-1388 SKILL.md:1388-1394 SKILL.md:1394-1395 SKILL.md:1395-1396 SKILL.md:1396-1397 SKILL.md:1397-1403 SKILL.md:1403-1404 SKILL.md:1404-1405 SKILL.md:1405-1406 SKILL.md:1406-1407 SKILL.md:1407 SKILL.md:1408-1414 SKILL.md:1414-1415 SKILL.md:1415-1416 SKILL.md:1416-1422 SKILL.md:1422-1423 SKILL.md:1423-1424 SKILL.md:1424-1425 SKILL.md:1425-1426 SKILL.md:1426-1427 SKILL.md:1427-1428 SKILL.md:1428-1434 SKILL.md:1434-1435 SKILL.md:1435 SKILL.md:1441-1479 SKILL.md:1479-1485 SKILL.md:1485-1539 SKILL.md:1539-1597 SKILL.md:1597-1614 SKILL.md:1614-1635 SKILL.md:1635-1648 SKILL.md:1648-1654 SKILL.md:1654-1660 SKILL.md:1660-1661 SKILL.md:1661-1662 SKILL.md:1662-1666 SKILL.md:1666-1692 SKILL.md:1692-1698 SKILL.md:1698-1699 SKILL.md:1699-1700 SKILL.md:1700-1701 SKILL.md:1701-1702 SKILL.md:1702-1703 SKILL.md:1703-1709 SKILL.md:1709-1713 SKILL.md:1713-1721 SKILL.md:1721-1726 SKILL.md:1726-1727 SKILL.md:1727-1734 SKILL.md:1734-1753 SKILL.md:1753-1759 SKILL.md:1759-1775 SKILL.md:1775-1812 SKILL.md:1812-1820 SKILL.md:1820-1841 SKILL.md:1841-1843 SKILL.md:1843-1875 SKILL.md:1875-1883 SKILL.md:1883-1884 SKILL.md:1884-1885 SKILL.md:1885-1888 SKILL.md:1888-1895 SKILL.md:1895-1905 SKILL.md:1905-1912 SKILL.md:1912-1918 SKILL.md:1918-1919 SKILL.md:1919-1920 SKILL.md:1920-1926 SKILL.md:1926-1932 SKILL.md:1932-1961 SKILL.md:1961-1972 SKILL.md:1972-1984 SKILL.md:1984-1985 SKILL.md:1985-1986 SKILL.md:1986-1987 SKILL.md:1987-1988 SKILL.md:1988-1989 SKILL.md:1989-1990 SKILL.md:1990-1996 SKILL.md:1996-1997 SKILL.md:1997-1998 SKILL.md:1998-2004 SKILL.md:2004-2005 SKILL.md:2005-2006 SKILL.md:2006-2007 SKILL.md:2007-2021 SKILL.md:2021-2033 SKILL.md:2033-2039 SKILL.md:2039-2040 SKILL.md:2040-2041 SKILL.md:2041-2042 SKILL.md:2042-2043 SKILL.md:2043-2044 SKILL.md:2044-2045 SKILL.md:2045-2046 SKILL.md:2046-2047 SKILL.md:2047-2048 SKILL.md:2048-2049 SKILL.md:2049-2050 SKILL.md:2050-2051 SKILL.md:2051 SKILL.md:2052-2058 SKILL.md:2058-2061 SKILL.md:2061-2083 SKILL.md:2083-2086 SKILL.md:2086-2092 SKILL.md:2092-2093 SKILL.md:2093-2094 SKILL.md:2094-2095 SKILL.md:2095-2096 SKILL.md:2096-2097 SKILL.md:2097-2098 SKILL.md:2098-2099 SKILL.md:2099-2100 SKILL.md:2100-2101 SKILL.md:2101-2102 SKILL.md:2102-2108 SKILL.md:2108-2109 SKILL.md:2109-2110 SKILL.md:2110-2111 SKILL.md:2111-2115 SKILL.md:2115-2126 SKILL.md:2126-2136 SKILL.md:2136-2146 SKILL.md:2146-2152 SKILL.md:2152-2160 SKILL.md:2160-2166 SKILL.md:2166-2171 SKILL.md:2171-2177 SKILL.md:2177-2190 SKILL.md:2190-2196 SKILL.md:2196-2201 SKILL.md:2201-2207 SKILL.md:2207 SKILL.md:2208-2209 SKILL.md:2209-2210 SKILL.md:2210-2211 SKILL.md:2211-2212 SKILL.md:2212-2218 SKILL.md:2218-2226 SKILL.md:2226-2262 SKILL.md:2262-2265 SKILL.md:2265-2267 SKILL.md:2267-2269 SKILL.md:2269-2517 SKILL.md:2517-2527 SKILL.md:2527-2530 SKILL.md:2530-2534 SKILL.md:2534-2544 SKILL.md:2544-2546 SKILL.md:2546-2561 SKILL.md:2561-2568 SKILL.md:2568-2585 SKILL.md:2585-2586 SKILL.md:2586-2587 SKILL.md:2587-2588 SKILL.md:2588-2589 SKILL.md:353 SKILL.md:475 SKILL.md:699 SKILL.md:775 SKILL.md:805 SKILL.md:833 SKILL.md:835 SKILL.md:836 SKILL.md:837 SKILL.md:1872 SKILL.md:348-392 SKILL.md:473-490 SKILL.md:697-737 SKILL.md:765-818 SKILL.md:824-861 SKILL.md:1843-1875 SKILL.md:349 SKILL.md:1442
📁 Filesystem access (59)
references/P1-task-agent-playbook.md:283 references/P1-task-agent-playbook.md:458 references/P1-task-agent-playbook.md:459 references/P1-task-agent-playbook.md:460 references/P5-multi-instance-protocol.md:870 references/P6-enforcement-setup.md:116 references/P6-enforcement-setup.md:171 references/P6-enforcement-setup.md:286 references/P6-enforcement-setup.md:38 references/P6-enforcement-setup.md:39 references/P6-enforcement-setup.md:40 references/P6-enforcement-setup.md:41 references/P6-enforcement-setup.md:42 references/P6-enforcement-setup.md:48 references/P6-enforcement-setup.md:49 references/P6-enforcement-setup.md:50 references/P6-enforcement-setup.md:51 references/P6-enforcement-setup.md:52 references/P6-enforcement-setup.md:53 references/P6-enforcement-setup.md:56 references/P6-enforcement-setup.md:57 references/P6-enforcement-setup.md:58 references/P6-enforcement-setup.md:59 references/P6-enforcement-setup.md:63 references/P6-enforcement-setup.md:65 references/P6-enforcement-setup.md:66 references/templates/issue-comment-format.md:10 references/templates/issue-comment-format.md:11 references/templates/issue-comment-format.md:12 references/templates/issue-comment-format.md:13 references/templates/issue-comment-format.md:14 references/templates/issue-comment-format.md:15 references/templates/issue-comment-format.md:16 references/templates/issue-comment-format.md:17 references/templates/issue-comment-format.md:18 references/templates/issue-comment-format.md:19 references/templates/issue-comment-format.md:20 references/templates/issue-comment-format.md:58 references/templates/issue-comment-format.md:73 SKILL.md:451 SKILL.md:457 SKILL.md:460 SKILL.md:463 SKILL.md:480 SKILL.md:486 SKILL.md:570 SKILL.md:702 SKILL.md:2060 SKILL.md:2111 SKILL.md:2159 SKILL.md:2181 SKILL.md:2185 SKILL.md:2188 SKILL.md:2262 SKILL.md:26 SKILL.md:26 SKILL.md:589 SKILL.md:1454 SKILL.md:1458
🔑 Env variables (14)
references/P2-epic-coordinator-playbook.md:416 references/P4-compaction-recovery-walkthrough.md:213 references/P4-compaction-recovery-walkthrough.md:225 references/P4-compaction-recovery-walkthrough.md:230 references/P4-compaction-recovery-walkthrough.md:232 references/P4-compaction-recovery-walkthrough.md:243 references/P4-compaction-recovery-walkthrough.md:251 references/P4-compaction-recovery-walkthrough.md:295 references/P4-compaction-recovery-walkthrough.md:314 references/P4-compaction-recovery-walkthrough.md:450 references/P5-multi-instance-protocol.md:257 references/P5-multi-instance-protocol.md:265 references/P5-multi-instance-protocol.md:282 references/P5-multi-instance-protocol.md:297
🌐 Network access (4)
Audited by: codex
Jun 29, 2026, 11:08 PM
Static analysis found many command, filesystem, environment, and network patterns, but contextual review shows this package is Markdown workflow documentation rather than executable hidden code. The main confirmed risk is that the playbooks instruct agents to run GitHub CLI, git, shell, workflow, and external tool setup commands, so publication is acceptable with an operational safety warning.
12
Files scanned
10,750
Lines analyzed
6
Review items
3
False positives ignored
Confirmed security concerns (2)
Medium
Operational Command Execution Guidance
The skill repeatedly instructs agents to run GitHub CLI, git, shell, and external setup commands. This is expected for a GitHub workflow skill, but commands can modify repositories, install MCP tooling, create labels, create workflows, change branches, and affect issue or PR state if run without review.
The command examples are direct and numerous, and their operational impact is clear. They are part of the skill purpose rather than hidden malicious code, so the risk is medium instead of high.
Medium
Repository and Filesystem Modification Guidance
The skill tells background agents where they may write, creates worktrees, removes worktrees, and writes report files. These instructions are useful for coordination but can alter local repository state and should be run in the intended project only.
The reviewed lines explicitly permit writes and show worktree cleanup commands. The scope is documented and not malicious, but the commands can affect local files.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Environment Variable Names in Examples
The scanner flagged database or environment access, but the reviewed content shows example configuration names such as REDIS_URL and documented safeguard variables. No real secret value or credential exfiltration instruction was found.
The evidence is plain documentation of variable names and example internal URLs. It should still remind users not to post real secrets in issues.
Low
Benign Relative Paths and Public Avatar URL
Path traversal and network findings are mostly relative asset paths and one public GitHub avatar URL in an issue comment template. These are not file-read or exfiltration logic.
The lines are a Markdown table of avatar paths and a public GitHub image URL. There is no executable code that reads arbitrary paths.
Low
Weak Cryptography and Windows SAM Matches Are False Positives
Several high and critical scanner hits are keyword collisions in prose, such as JWT examples, RS256 review text, and the word SAME. No evidence of weak cryptographic implementation or Windows SAM database access was found in the reviewed Markdown context.
The cited lines show coordination prose and review checklist examples, not code that implements cryptography or accesses operating system credential stores.
Risk Factors
⚙️ External commands (3)
📁 Filesystem access (3)
🔑 Env variables (2)
Detected Patterns
Copy-Paste Shell and GitHub CLI Blocks
Audited by: codex
Jan 23, 2026, 02:30 AM
This skill contains documentation and agent playbooks only. Static findings are false positives triggered by documentation examples of shell commands and git operations. No executable code with security implications. The skill provides workflow guidance for using GitHub Issues as persistent memory.
12
Files scanned
10,750
Lines analyzed
2
Review items
0
False positives ignored
Risk Factors
⚡ Contains scripts (1)
📁 Filesystem access (1)
Audited by: claude
Jan 17, 2026, 05:02 AM
Documentation-only skill containing markdown files with workflow protocols. All static findings (1338 potential issues) are FALSE POSITIVES. Shell commands and git/gh CLI examples appear in markdown documentation blocks, not executable code. The skill is a pure protocol framework for GitHub-based persistent memory with no malicious patterns.
13
Files scanned
11,014
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (2)
📁 Filesystem access (2)
🌐 Network access (2)
Audited by: claude
Jan 17, 2026, 05:02 AM
Documentation-only skill containing markdown files with workflow protocols. All static findings (1338 potential issues) are FALSE POSITIVES. Shell commands and git/gh CLI examples appear in markdown documentation blocks, not executable code. The skill is a pure protocol framework for GitHub-based persistent memory with no malicious patterns.
13
Files scanned
11,014
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (2)
📁 Filesystem access (2)
🌐 Network access (2)
Audited by: claude
Jan 10, 2026, 02:56 PM
Pure documentation skill with no executable code. Contains markdown files with workflow protocols and bash command examples using gh CLI for GitHub operations. No scripts, no network calls, no file system access beyond project directory.
12
Files scanned
11,750
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 02:56 PM
Pure documentation skill with no executable code. Contains markdown files with workflow protocols and bash command examples using gh CLI for GitHub operations. No scripts, no network calls, no file system access beyond project directory.
12
Files scanned
11,750
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 02:56 PM
Pure documentation skill with no executable code. Contains markdown files with workflow protocols and bash command examples using gh CLI for GitHub operations. No scripts, no network calls, no file system access beyond project directory.
12
Files scanned
11,750
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude