Skills business-conflict-analyzer
๐Ÿ“ฆ

business-conflict-analyzer

Content revision r1 High Risk โš™๏ธ External commands๐Ÿ“ Filesystem access๐Ÿ”‘ Env variablesโšก Contains scripts๐ŸŒ Network access

Analyze Breaking Changes Before You Commit

Contract and schema changes can break downstream services, clients, and data flows. This skill maps affected references and produces a business impact report before commit.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "business-conflict-analyzer" from https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer.md and its manifest at https://skillstore.io/api/skills/gobeyondyang-business-conflict-analyzer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/gobeyondyang-business-conflict-analyzer.md Signed manifest GET /api/skills/gobeyondyang-business-conflict-analyzer/manifest Signed lockfile GET /api/skills/gobeyondyang-business-conflict-analyzer/lockfile

Test it

Using "business-conflict-analyzer". Rename UserDTO.mobile to phone and assess downstream impact.

Expected outcome:

  • Risk: High because existing consumers still reference the removed field.
  • Affected areas: service mappings, frontend profile views, tests, and stored data migration.
  • Recommendation: retain a compatibility field, update consumers, migrate data, and verify contracts before removal.

Using "business-conflict-analyzer". Change the orders endpoint from version one to version two.

Expected outcome:

  • Risk: Medium when the old route remains available during migration.
  • Affected areas: API clients, routing tests, documentation, monitoring, and deployment configuration.
  • Recommendation: add the new route, deprecate the old route, notify owners, and monitor adoption.

Using "business-conflict-analyzer". Drop a database column used by an event producer.

Expected outcome:

  • Risk: High because historical data and message consumers can lose required values.
  • Required actions: inventory references, backfill or archive data, version the event schema, and coordinate deployment order.

Security Audit

High Risk
v4 โ€ข 7/19/2026 Open versioned report

Most static alerts are false positives from Markdown, test fixtures, locale handling, fixed argv subprocess calls, and readable multilingual files. Confirmed risks include mutable remote fetches, out-of-repository scanning, persistent agent configuration changes, and a destructive repository-wide rollback directive. The skill also claims blanket authority for broad consumer edits, which is a high-confidence prompt injection risk.

22
Files scanned
5,440
Lines analyzed
12
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:314SKILL.md:340
Prompt Injection Attempt Detected
SKILL.md states, "AI knows it's authorized to fix all consumers" and says, "Do not ask the user per-consumer." This converts one acceptance into blanket authority for broad edits.
The text explicitly claims expanded authorization and suppresses per-consumer confirmation. The directive is clear and directly affects agent edit scope.
Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
scripts/impact_mapper.py:392
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer deliberately searches ../frontend, ../web, and ../../frontend, crossing the selected repository boundary. This can read source from sibling directories without separate scope approval.
High
SKILL.md:279-288
Ruby/shell backtick execution
| **โ†’ 2** โŒ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill explicitly directs the agent to run git checkout -- . when the user rejects a proposal. That command discards all tracked working-tree changes, including unrelated work.
Medium
scripts/impact_mapper.py:382
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT accepts path lists, including absolute paths, and those locations are recursively searched. A configured value can expand file access beyond the audited project.
Medium
scripts/install_hook.sh:29
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json, a hidden agent configuration file, to register a persistent executable hook. The behavior is disclosed but remains security-sensitive.
Medium
scripts/install_hook.sh:66
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites an existing agent settings file after adding a PreToolUse command. This persistent configuration change can affect later tool execution.
Medium
SKILL.md:4
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:6
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:8
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:10
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:12
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:14
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
SKILL.md:16
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.

Risk Factors

โš™๏ธ External commands (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:21 SKILL.md:24 SKILL.md:27 SKILL.md:30 SKILL.md:53 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:66 SKILL.md:74 SKILL.md:75 SKILL.md:80 SKILL.md:82 SKILL.md:87 SKILL.md:100 SKILL.md:108-131 SKILL.md:131-154 SKILL.md:154-155 SKILL.md:155-156 SKILL.md:156-157 SKILL.md:157-165 SKILL.md:165 SKILL.md:168-170 SKILL.md:170-172 SKILL.md:172 SKILL.md:174 SKILL.md:176-178 SKILL.md:178-180 SKILL.md:180 SKILL.md:188-189 SKILL.md:189-193 SKILL.md:193-194
๐Ÿ“ Filesystem access (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
๐Ÿ”‘ Env variables (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
โšก Contains scripts (3)
scripts/report_generator.py:422 tests/test_diff_analyzer.py:12-18 tests/test_impact_mapper.py:12-16
๐ŸŒ Network access (8)
SKILL.md:4 SKILL.md:6 SKILL.md:8 SKILL.md:10 SKILL.md:12 SKILL.md:14 SKILL.md:16 tests/test_diff_analyzer.py:246
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/gobeyondyang-business-conflict-analyzer/security.svg)](https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/gobeyondyang-business-conflict-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/gobeyondyang-business-conflict-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

gobeyondyang. (2026). business-conflict-analyzer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4

BibTeX citation

@techreport{gobeyondyang-gobeyondyang-business-conflict-analyzer-2026, author = {gobeyondyang}, title = {business-conflict-analyzer security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "business-conflict-analyzer security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "gobeyondyang" date-released: "2026-07-19" url: "https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4" identifiers: - type: other value: "skillstore:gobeyondyang-business-conflict-analyzer:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
77
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Review API contract changes

Trace DTO, endpoint, and response changes to backend clients, frontend consumers, and compatibility requirements.

Plan database migrations

Assess DDL changes, existing data risks, service dependencies, and required rollout sequencing.

Coordinate cross-stack releases

Produce a shared impact report for services, web clients, tests, and business owners before approval.

Try These Prompts

Analyze current changes 
Analyze my current Git changes. List breaking changes, affected consumers, migration needs, and recommended next steps. Do not modify files.
Review a field rename 
Review the rename of [old field] to [new field] in [contract]. Find backend and frontend consumers. Propose backward-compatible migration steps.
Assess a schema release 
Analyze the DDL and API changes since [revision]. Map data, service, message, and client impacts. Produce a phased rollout and rollback plan.
Audit staged changes for commit 
Analyze staged changes only. Identify P0 and P1 risks, explain evidence, and provide decision options. Do not install hooks or discard changes.

Best Practices

  • Run analysis from the intended repository root and review every external scan path before execution.
  • Compare findings with compilation, tests, schema checks, and service-owner confirmation before approving changes.
  • Use pinned skill assets and review the report before applying compatibility fixes or installing the commit guard.

Avoid

  • Do not treat a clean report as proof that unsupported languages, generated code, or dynamic consumers are unaffected.
  • Do not approve repository-wide automatic fixes without reviewing the complete file list and intended scope.
  • Do not use broad rollback commands when unrelated working-tree changes may exist.

Frequently Asked Questions

Which languages and frameworks are supported?
It includes rules for Java, Kotlin, Python, TypeScript, JavaScript, Go, Vue, React, JSP, SQL, YAML, XML, and common web frameworks.
Does it modify my code?
Analysis scripts generate a report. The skill documentation also proposes optional fixes, rollback actions, and hook installation that require careful approval.
Can it block a Git commit?
Yes. The optional Claude Code hook runs the analyzer before git commit and blocks changes classified as P0.
Does it replace tests or compilation?
No. It uses heuristics and reference searches. Confirm important findings with builds, tests, contract validation, and owner review.
Where is the report saved?
The command-line pipeline writes conflict-report.md in the current project directory and can overwrite an existing file with that name.
Does it require network access?
The included scripts are local, but the skill frontmatter automatically fetches companion files from GitHub when loaded.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/gobeyondyang/skills/tree/main/skills/business-conflict-analyzer

Ref

536932510ff0a3e976ac88662d9e038a7faa088b

Maintenance freshness

7/20/2026

Usage

0 downloads ยท 0 views

File structure

๐Ÿ“ .evalkit/

๐Ÿ“„ negative-prompts.txt

๐Ÿ“„ positive-prompts-multilang.txt

๐Ÿ“„ positive-prompts.txt

๐Ÿ“„ .gitignore

๐Ÿ“„ analyze.sh

๐Ÿ“ docs/

๐Ÿ“„ AI ๅˆ†ๆžๅ†ณ็ญ–ๅทฅไฝœๆต.png

๐Ÿ“„ impact-graph.png

๐Ÿ“„ sample-report-en.md

๐Ÿ“„ sample-report-zh.md

๐Ÿ“„ ๅ†ณ็ญ–ๆ‰ง่กŒไธŽ่‡ชๅŠจไฟฎๅค้—ญ็Žฏ.png

๐Ÿ“„ ๅฏน่ฏ-ๆต‹่ฏ•ๆ•ˆๆžœ.png

๐Ÿ“„ README.md

๐Ÿ“ references/

๐Ÿ“„ common_patterns.md

๐Ÿ“ scripts/

๐Ÿ“„ commit_guard.py

๐Ÿ“„ diff_analyzer.py

๐Ÿ“„ impact_mapper.py

๐Ÿ“„ install_hook.sh

๐Ÿ“„ lang.py

๐Ÿ“„ report_generator.py

๐Ÿ“„ SKILL.md

๐Ÿ“ tests/

๐Ÿ“„ run_all.py

๐Ÿ“„ test_commit_guard.py

๐Ÿ“„ test_diff_analyzer.py

๐Ÿ“„ test_impact_mapper.py

๐Ÿ“„ test_lang.py

๐Ÿ“„ test_report_generator.py

Related Skills

View all