📦
Audit History
business-conflict-analyzer - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 4 Latest
Jul 19, 2026, 08:56 AM
Most static alerts are false positives from Markdown, test fixtures, locale handling, fixed argv subprocess calls, and readable multilingual files. Confirmed risks include mutable remote fetches, out-of-repository scanning, persistent agent configuration changes, and a destructive repository-wide rollback directive. The skill also claims blanket authority for broad consumer edits, which is a high-confidence prompt injection risk.
22
Files scanned
5,440
Lines analyzed
18
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Prompt Injection Attempt Detected
SKILL.md states, "AI knows it's authorized to fix all consumers" and says, "Do not ask the user per-consumer." This converts one acceptance into blanket authority for broad edits.
The text explicitly claims expanded authorization and suppresses per-consumer confirmation. The directive is clear and directly affects agent edit scope.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer deliberately searches ../frontend, ../web, and ../../frontend, crossing the selected repository boundary. This can read source from sibling directories without separate scope approval.
High
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill explicitly directs the agent to run git checkout -- . when the user rejects a proposal. That command discards all tracked working-tree changes, including unrelated work.
Medium
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT accepts path lists, including absolute paths, and those locations are recursively searched. A configured value can expand file access beyond the audited project.
Medium
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json, a hidden agent configuration file, to register a persistent executable hook. The behavior is disclosed but remains security-sensitive.
Medium
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites an existing agent settings file after adding a PreToolUse command. This persistent configuration change can affect later tool execution.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
Risk Factors
⚙️ External commands (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:21 SKILL.md:24 SKILL.md:27 SKILL.md:30 SKILL.md:53 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:66 SKILL.md:74 SKILL.md:75 SKILL.md:80 SKILL.md:82 SKILL.md:87 SKILL.md:100 SKILL.md:108-131 SKILL.md:131-154 SKILL.md:154-155 SKILL.md:155-156 SKILL.md:156-157 SKILL.md:157-165 SKILL.md:165 SKILL.md:168-170 SKILL.md:170-172 SKILL.md:172 SKILL.md:174 SKILL.md:176-178 SKILL.md:178-180 SKILL.md:180 SKILL.md:188-189 SKILL.md:189-193 SKILL.md:193-194
📁 Filesystem access (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
🔑 Env variables (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
⚡ Contains scripts (3)
🌐 Network access (8)
Audited by: codex
Jul 10, 2026, 04:28 PM
Most static alerts are false positives from Markdown backticks, test fixtures, locale access, and fixed-argument local commands. Confirmed risks include mutable automatic downloads, Git option injection, out-of-repository scans, persistent hook writes, report overwrites, destructive rollback, and overbroad autonomous-edit instructions. These issues require remediation before unrestricted publication.
22
Files scanned
5,484
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Prompt Injection Attempt Detected
The skill states, "AI knows it's authorized to fix all consumers," and, "Do not ask the user per-consumer." This expands one approval into broad repository modification authority.
The cited section explicitly grants broad scope and suppresses further confirmation. The language directly changes the agent's authorization behavior.
Medium
Fixed Report Path Can Overwrite Project Data
The analyzer writes conflict-report.md to the project root without checking whether the file already exists. Repeated runs can replace unrelated user content.
Both locations use a fixed filename and direct write operations with no existence check, backup, or alternate output path.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(
The --since value reaches git diff before a path separator and is not validated as a revision. A value shaped like a Git option can change command behavior.
High
Python subprocess.run
result2 = subprocess.run(
The encoding retry executes the same unvalidated git diff argument list. A crafted --since value can still be interpreted as a Git option.
High
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer intentionally probes ../frontend, ../web, and ../../frontend. This can read source files outside the repository selected by the user.
High
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill directs the agent to run git checkout -- . when the user chooses Reject. This discards all tracked working-tree changes, including unrelated work.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch frontmatter automatically downloads executable diff_analyzer.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch frontmatter automatically downloads executable impact_mapper.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch frontmatter automatically downloads executable report_generator.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch frontmatter automatically downloads executable lang.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch frontmatter automatically downloads executable commit_guard.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch frontmatter automatically downloads executable install_hook.sh from the mutable main branch without a commit pin or integrity check.
Medium
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT controls additional scan roots and accepts absolute paths. A configured value can expand file inspection beyond the current project.
Medium
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json and creates the hidden configuration directory. This persists a command hook in the user's project.
Medium
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites settings.local.json to register a future command hook. Existing settings are parsed and preserved, but the persistent configuration change is security relevant.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch frontmatter downloads mutable analysis rules without a commit pin or integrity check. Altered rules can change reported impact and agent decisions.
Risk Factors
⚙️ External commands (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:65 SKILL.md:68 SKILL.md:71 SKILL.md:74 SKILL.md:97 SKILL.md:99 SKILL.md:100 SKILL.md:102 SKILL.md:110 SKILL.md:118 SKILL.md:119 SKILL.md:124 SKILL.md:126 SKILL.md:131 SKILL.md:144 SKILL.md:152-175 SKILL.md:175-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-209 SKILL.md:209 SKILL.md:212-214 SKILL.md:214-216 SKILL.md:216 SKILL.md:218 SKILL.md:220-222 SKILL.md:222-224 SKILL.md:224 SKILL.md:232-233 SKILL.md:233-237 SKILL.md:237-238
📁 Filesystem access (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
🔑 Env variables (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
⚡ Contains scripts (3)
🌐 Network access (8)
Audited by: codex
Jul 10, 2026, 04:28 PM
Most static alerts are false positives from Markdown backticks, test fixtures, locale access, and fixed-argument local commands. Confirmed risks include mutable automatic downloads, Git option injection, out-of-repository scans, persistent hook writes, report overwrites, destructive rollback, and overbroad autonomous-edit instructions. These issues require remediation before unrestricted publication.
22
Files scanned
5,484
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Prompt Injection Attempt Detected
The skill states, "AI knows it's authorized to fix all consumers," and, "Do not ask the user per-consumer." This expands one approval into broad repository modification authority.
The cited section explicitly grants broad scope and suppresses further confirmation. The language directly changes the agent's authorization behavior.
Medium
Fixed Report Path Can Overwrite Project Data
The analyzer writes conflict-report.md to the project root without checking whether the file already exists. Repeated runs can replace unrelated user content.
Both locations use a fixed filename and direct write operations with no existence check, backup, or alternate output path.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(
The --since value reaches git diff before a path separator and is not validated as a revision. A value shaped like a Git option can change command behavior.
High
Python subprocess.run
result2 = subprocess.run(
The encoding retry executes the same unvalidated git diff argument list. A crafted --since value can still be interpreted as a Git option.
High
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer intentionally probes ../frontend, ../web, and ../../frontend. This can read source files outside the repository selected by the user.
High
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill directs the agent to run git checkout -- . when the user chooses Reject. This discards all tracked working-tree changes, including unrelated work.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch frontmatter automatically downloads executable diff_analyzer.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch frontmatter automatically downloads executable impact_mapper.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch frontmatter automatically downloads executable report_generator.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch frontmatter automatically downloads executable lang.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch frontmatter automatically downloads executable commit_guard.py from the mutable main branch without a commit pin or integrity check.
High
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch frontmatter automatically downloads executable install_hook.sh from the mutable main branch without a commit pin or integrity check.
Medium
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT controls additional scan roots and accepts absolute paths. A configured value can expand file inspection beyond the current project.
Medium
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json and creates the hidden configuration directory. This persists a command hook in the user's project.
Medium
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites settings.local.json to register a future command hook. Existing settings are parsed and preserved, but the persistent configuration change is security relevant.
Medium
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch frontmatter downloads mutable analysis rules without a commit pin or integrity check. Altered rules can change reported impact and agent decisions.
Risk Factors
⚙️ External commands (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:65 SKILL.md:68 SKILL.md:71 SKILL.md:74 SKILL.md:97 SKILL.md:99 SKILL.md:100 SKILL.md:102 SKILL.md:110 SKILL.md:118 SKILL.md:119 SKILL.md:124 SKILL.md:126 SKILL.md:131 SKILL.md:144 SKILL.md:152-175 SKILL.md:175-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-209 SKILL.md:209 SKILL.md:212-214 SKILL.md:214-216 SKILL.md:216 SKILL.md:218 SKILL.md:220-222 SKILL.md:222-224 SKILL.md:224 SKILL.md:232-233 SKILL.md:233-237 SKILL.md:237-238
📁 Filesystem access (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
🔑 Env variables (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
⚡ Contains scripts (3)
🌐 Network access (8)
Audited by: codex
Jul 9, 2026, 09:25 AM
Most static findings are false positives from Markdown code spans, Mermaid samples, unit-test fixtures, and fixed git or grep argument lists. Confirmed risks remain around unpinned remote script fetches, persistent commit-hook installation, parent-directory frontend scanning, destructive rollback guidance, and broad autonomous code modification instructions.
22
Files scanned
5,484
Lines analyzed
32
Review items
0
False positives ignored
Confirmed security concerns (5)
High
System reconnaissance
| **Scope authorization** | AI may hesitate: "Did user really want me to touch OrderService?" | AI k
The line says the assistant knows it is authorized to fix all consumers. The static category is inaccurate, but the text creates an overbroad authorization risk.
High
Unpinned Remote Script Fetches
The skill fetches executable helper scripts from GitHub raw URLs on the main branch. Mutable remote script loading can change behavior after marketplace review.
The fetch frontmatter explicitly lists raw GitHub URLs for Python and shell helper files, and the prose says they download automatically. I found no hash or immutable commit pin in those lines.
High
SKILL.md:205-216scripts/install_hook.sh:8-10scripts/install_hook.sh:61-67scripts/commit_guard.py:3-9
Persistent Commit Hook Installation
The optional installer writes a Claude Code PreToolUse hook that intercepts git commit and runs the guard script. This persists behavior in a hidden project configuration file.
The skill instructions and installer both state that a PreToolUse hook is added for git commit, and the script writes that hook into settings.local.json.
High
Destructive Rollback Command Guidance
The post-guard decision table tells the assistant to run git checkout -- . when a user rejects a change. That can discard unrelated working tree changes without per-file review.
The exact rollback command appears in the reject path, and the next line says the assistant should autonomously execute actions after the user chooses an option.
High
Overbroad Autonomous Code Modification Scope
The skill tells the assistant to automatically fix all impacted consumer sites and not ask per consumer. This can authorize broad edits beyond the original requested files.
The instructions repeatedly say the assistant must fix all impacted consumers automatically, including a statement not to ask the user per consumer.
Capability review items (22)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The fallback frontend search includes parent and sibling paths such as ../frontend and ../../frontend. This is useful for monorepos, but it can read outside the current project scope.
High
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The line recommends git checkout -- . to discard changes after a reject decision. That command can erase unrelated working tree changes, so it is a real destructive-action risk.
High
Ruby/shell backtick execution
After the user accepts a change (whether via the Post-Guard protocol or in normal conversation), the
The line requires the assistant to automatically fix all impacted consumer sites after acceptance. This authorizes broad edits beyond the original file set and can exceed user intent.
High
Ruby/shell backtick execution
用户确认采纳变更后(无论是通过拦截后闭环追问还是在正常对话中),AI **必须**自动修复 `impact_mapper.py` 识别的**所有受影响引用方**,而不仅仅是原改动代码。
The Chinese duplicate requires automatic repair of all impacted references, not only original code. This confirms broad autonomous edit scope.
Medium
Ruby/shell backtick execution
Intercepts `git commit` via Claude Code PreToolUse hook.
The executable script is intended to intercept git commit through a Claude Code hook. This is not Ruby backtick execution, but the hook behavior itself is real.
Medium
Ruby/shell backtick execution
# .claude/settings.local.json that intercepts `git commit` and runs
The installer is designed to add a hook that intercepts git commit. The line is a comment, but it accurately describes persistent command interception implemented later in the script.
Medium
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets the hidden .claude directory in the current project. Writing hidden assistant configuration is intentional but security relevant.
Medium
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The inline Python writes settings.local.json to add a PreToolUse hook. This persists behavior in project configuration and should require clear confirmation.
Medium
Ruby/shell backtick execution
> ⚠️ **IMPORTANT — Companion files (scripts/, references/) download automatically via `fetch`**
The line tells the assistant that companion files download automatically through fetch. Static labeled the Markdown backticks, but the remote auto-fetch behavior is a real supply-chain concern.
Medium
Ruby/shell backtick execution
> The `fetch` frontmatter above handles this automatically when the skill is loaded.
The line reinforces automatic fetch behavior for scripts and references. This is expected skill packaging, but it relies on mutable remote resources.
Medium
Ruby/shell backtick execution
> **重要 — `fetch` 前奏会自动下载配套文件(scripts/、references/)**
The Chinese duplicate reiterates automatic companion file download through fetch. The behavior is real even though the static pattern is Markdown backtick noise.
Medium
Ruby/shell backtick execution
> 上述 `fetch` 前奏会在 skill 加载时自动处理。手动下载会干扰自动机制,可能产生重复文件。
The line instructs users not to manually download because fetch handles companion files. This confirms dependence on automatic remote retrieval, which should be pinned or verified.
Medium
Ruby/shell backtick execution
This registers a `PreToolUse` hook (via `.claude/settings.local.json`) that intercepts `git commit`
The line states that the skill registers a PreToolUse hook in .claude/settings.local.json to intercept git commit. Persistent command interception is a real marketplace security concern.
Medium
Ruby/shell backtick execution
When `commit_guard.py` blocks a commit (P0 detected), the AI MUST automatically engage the user in a
The line tells the assistant to proactively re-engage after commit blocking. It is part of the guard workflow and increases autonomous behavior around repository changes.
Medium
Ruby/shell backtick execution
当 `commit_guard.py` 拦截了 commit(检测到 P0 破坏性变更),AI **必须**自动发起闭环追问决策。不要只报告拦截结果就结束——要主动问用户怎么处理。
The Chinese duplicate tells the assistant to automatically start a decision loop after a blocked commit. This is not shell execution, but it confirms autonomous guard behavior.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch frontmatter downloads an executable helper script from a GitHub raw URL on the main branch. This is legitimate packaging, but it is an unpinned remote code supply-chain surface.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch frontmatter downloads an executable helper script from a GitHub raw URL on the main branch. This is legitimate packaging, but it is an unpinned remote code supply-chain surface.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch frontmatter downloads the report generator from a GitHub raw URL on the main branch. This is a real supply-chain risk because the fetched code is not pinned by immutable hash.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch frontmatter downloads a helper module from a GitHub raw URL on the main branch. It is expected for this skill, but the remote source is mutable.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch frontmatter downloads the commit guard script from a GitHub raw URL on the main branch. Because this script can run as a hook, mutable remote retrieval is a real risk.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch frontmatter downloads the hook installer from a GitHub raw URL on the main branch. The installer changes local Claude settings, so unpinned retrieval is security relevant.
Low
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch frontmatter downloads the reference library from a GitHub raw URL on the main branch. This is lower risk than code, but it still lets mutable remote prose affect analysis behavior.
Risk Factors
⚙️ External commands (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:65 SKILL.md:68 SKILL.md:71 SKILL.md:74 SKILL.md:97 SKILL.md:99 SKILL.md:100 SKILL.md:102 SKILL.md:110 SKILL.md:118 SKILL.md:119 SKILL.md:124 SKILL.md:126 SKILL.md:131 SKILL.md:144 SKILL.md:152-175 SKILL.md:175-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-209 SKILL.md:209 SKILL.md:212-214 SKILL.md:214-216 SKILL.md:216 SKILL.md:218 SKILL.md:220-222 SKILL.md:222-224 SKILL.md:224 SKILL.md:232-233 SKILL.md:233-237 SKILL.md:237-238
📁 Filesystem access (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
🔑 Env variables (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
⚡ Contains scripts (3)
🌐 Network access (8)
Detected Patterns
System reconnaissance
Audited by: codex