Versioned security assessment

Report ID: SA-1438EF11

7/9/2026, 9:25:55 AM

business-conflict-analyzer security assessment v1

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
business-conflict-analyzer
Version
v1
Maintainer
gobeyondyang
Source
github.com/gobeyondyang/skills/tree/main/skills/business-conflict-analyzer
Coverage
22 Files scanned · 5,484 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from Markdown code spans, Mermaid samples, unit-test fixtures, and fixed git or grep argument lists. Confirmed risks remain around unpinned remote script fetches, persistent commit-hook installation, parent-directory frontend scanning, destructive rollback guidance, and broad autonomous code modification instructions.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

22 Files scanned · 5,484 Lines analyzed

27 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 21 evidence locations

Env variables

May read values from the process environment.

Observed in 14 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 55 evidence locations

Capability review items (22)
High
scripts/impact_mapper.py:392
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The fallback frontend search includes parent and sibling paths such as ../frontend and ../../frontend. This is useful for monorepos, but it can read outside the current project scope.
High
SKILL.md:323-332
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The line recommends git checkout -- . to discard changes after a reject decision. That command can erase unrelated working tree changes, so it is a real destructive-action risk.
High
SKILL.md:349-351
Ruby/shell backtick execution
After the user accepts a change (whether via the Post-Guard protocol or in normal conversation), the
The line requires the assistant to automatically fix all impacted consumer sites after acceptance. This authorizes broad edits beyond the original file set and can exceed user intent.
High
SKILL.md:351-367
Ruby/shell backtick execution
用户确认采纳变更后(无论是通过拦截后闭环追问还是在正常对话中),AI **必须**自动修复 `impact_mapper.py` 识别的**所有受影响引用方**,而不仅仅是原改动代码。
The Chinese duplicate requires automatic repair of all impacted references, not only original code. This confirms broad autonomous edit scope.
Medium
scripts/commit_guard.py:5
Ruby/shell backtick execution
Intercepts `git commit` via Claude Code PreToolUse hook.
The executable script is intended to intercept git commit through a Claude Code hook. This is not Ruby backtick execution, but the hook behavior itself is real.
Medium
scripts/install_hook.sh:9
Ruby/shell backtick execution
# .claude/settings.local.json that intercepts `git commit` and runs
The installer is designed to add a hook that intercepts git commit. The line is a comment, but it accurately describes persistent command interception implemented later in the script.
Medium
scripts/install_hook.sh:29
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets the hidden .claude directory in the current project. Writing hidden assistant configuration is intentional but security relevant.
Medium
scripts/install_hook.sh:66
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The inline Python writes settings.local.json to add a PreToolUse hook. This persists behavior in project configuration and should require clear confirmation.
Medium
SKILL.md:65
Ruby/shell backtick execution
> ⚠️ **IMPORTANT — Companion files (scripts/, references/) download automatically via `fetch`**
The line tells the assistant that companion files download automatically through fetch. Static labeled the Markdown backticks, but the remote auto-fetch behavior is a real supply-chain concern.
Medium
SKILL.md:68
Ruby/shell backtick execution
> The `fetch` frontmatter above handles this automatically when the skill is loaded.
The line reinforces automatic fetch behavior for scripts and references. This is expected skill packaging, but it relies on mutable remote resources.
Medium
SKILL.md:71
Ruby/shell backtick execution
> **重要 — `fetch` 前奏会自动下载配套文件(scripts/、references/)**
The Chinese duplicate reiterates automatic companion file download through fetch. The behavior is real even though the static pattern is Markdown backtick noise.
Medium
SKILL.md:74
Ruby/shell backtick execution
> 上述 `fetch` 前奏会在 skill 加载时自动处理。手动下载会干扰自动机制,可能产生重复文件。
The line instructs users not to manually download because fetch handles companion files. This confirms dependence on automatic remote retrieval, which should be pinned or verified.
Medium
SKILL.md:216
Ruby/shell backtick execution
This registers a `PreToolUse` hook (via `.claude/settings.local.json`) that intercepts `git commit`
The line states that the skill registers a PreToolUse hook in .claude/settings.local.json to intercept git commit. Persistent command interception is a real marketplace security concern.
Medium
SKILL.md:264-266
Ruby/shell backtick execution
When `commit_guard.py` blocks a commit (P0 detected), the AI MUST automatically engage the user in a
The line tells the assistant to proactively re-engage after commit blocking. It is part of the guard workflow and increases autonomous behavior around repository changes.
Medium
SKILL.md:266-270
Ruby/shell backtick execution
当 `commit_guard.py` 拦截了 commit(检测到 P0 破坏性变更),AI **必须**自动发起闭环追问决策。不要只报告拦截结果就结束——要主动问用户怎么处理。
The Chinese duplicate tells the assistant to automatically start a decision loop after a blocked commit. This is not shell execution, but it confirms autonomous guard behavior.
Low
SKILL.md:4
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch frontmatter downloads an executable helper script from a GitHub raw URL on the main branch. This is legitimate packaging, but it is an unpinned remote code supply-chain surface.
Low
SKILL.md:6
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch frontmatter downloads an executable helper script from a GitHub raw URL on the main branch. This is legitimate packaging, but it is an unpinned remote code supply-chain surface.
Low
SKILL.md:8
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch frontmatter downloads the report generator from a GitHub raw URL on the main branch. This is a real supply-chain risk because the fetched code is not pinned by immutable hash.
Low
SKILL.md:10
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch frontmatter downloads a helper module from a GitHub raw URL on the main branch. It is expected for this skill, but the remote source is mutable.
Low
SKILL.md:12
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch frontmatter downloads the commit guard script from a GitHub raw URL on the main branch. Because this script can run as a hook, mutable remote retrieval is a real risk.
Low
SKILL.md:14
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch frontmatter downloads the hook installer from a GitHub raw URL on the main branch. The installer changes local Claude settings, so unpinned retrieval is security relevant.
Low
SKILL.md:16
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch frontmatter downloads the reference library from a GitHub raw URL on the main branch. This is lower risk than code, but it still lets mutable remote prose affect analysis behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High
SKILL.md:358
System reconnaissance
| **Scope authorization** | AI may hesitate: "Did user really want me to touch OrderService?" | AI k
The line says the assistant knows it is authorized to fix all consumers. The static category is inaccurate, but the text creates an overbroad authorization risk.
RISK-002 High
SKILL.md:3-16SKILL.md:65-74
Unpinned Remote Script Fetches
The skill fetches executable helper scripts from GitHub raw URLs on the main branch. Mutable remote script loading can change behavior after marketplace review.
The fetch frontmatter explicitly lists raw GitHub URLs for Python and shell helper files, and the prose says they download automatically. I found no hash or immutable commit pin in those lines.
RISK-003 High
SKILL.md:205-216scripts/install_hook.sh:8-10scripts/install_hook.sh:61-67scripts/commit_guard.py:3-9
Persistent Commit Hook Installation
The optional installer writes a Claude Code PreToolUse hook that intercepts git commit and runs the guard script. This persists behavior in a hidden project configuration file.
The skill instructions and installer both state that a PreToolUse hook is added for git commit, and the script writes that hook into settings.local.json.
RISK-004 High
SKILL.md:316-326
Destructive Rollback Command Guidance
The post-guard decision table tells the assistant to run git checkout -- . when a user rejects a change. That can discard unrelated working tree changes without per-file review.
The exact rollback command appears in the reject path, and the next line says the assistant should autonomously execute actions after the user chooses an option.
RISK-005 High
SKILL.md:347-384
Overbroad Autonomous Code Modification Scope
The skill tells the assistant to automatically fix all impacted consumer sites and not ask per consumer. This can authorize broad edits beyond the original requested files.
The instructions repeatedly say the assistant must fix all impacted consumers automatically, including a statement not to ask the user per consumer.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Unpinned remote helper downloads
    Pin fetch URLs to immutable commits or package the helper files directly with integrity verification.
  2. FIX-002
    High
    Persistent Claude Code commit hook
    Require explicit confirmation, show the exact settings diff, document uninstall steps, and avoid automatic hook installation.
  3. FIX-003
    High
    Repository-wide rollback command
    Replace git checkout -- . guidance with a reviewed file list, patch reversal, or stash-based recovery plan.
  4. FIX-004
    High
    Overbroad autonomous consumer fixes
    Require a proposed file list and user confirmation before editing each impacted consumer area.
  5. FIX-005
    Medium
    Frontend scan can leave the project root
    Restrict scans to the repository by default and require explicit confirmation for parent, sibling, or absolute frontend roots.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable