Versioned security assessment

Report ID: SA-B9E5AE9C

7/10/2026, 4:28:33 PM

business-conflict-analyzer security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
business-conflict-analyzer
Version
v2
Maintainer
gobeyondyang
Source
github.com/gobeyondyang/skills/tree/main/skills/business-conflict-analyzer
Coverage
22 Files scanned · 5,484 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives from Markdown backticks, test fixtures, locale access, and fixed-argument local commands. Confirmed risks include mutable automatic downloads, Git option injection, out-of-repository scans, persistent hook writes, report overwrites, destructive rollback, and overbroad autonomous-edit instructions. These issues require remediation before unrestricted publication.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

22 Files scanned · 5,484 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 21 evidence locations

Env variables

May read values from the process environment.

Observed in 14 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 51 evidence locations

Capability review items (14)
High
scripts/diff_analyzer.py:64
Python subprocess.run
result = subprocess.run(
The --since value reaches git diff before a path separator and is not validated as a revision. A value shaped like a Git option can change command behavior.
High
scripts/diff_analyzer.py:75
Python subprocess.run
result2 = subprocess.run(
The encoding retry executes the same unvalidated git diff argument list. A crafted --since value can still be interpreted as a Git option.
High
scripts/impact_mapper.py:392
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer intentionally probes ../frontend, ../web, and ../../frontend. This can read source files outside the repository selected by the user.
High
SKILL.md:323-332
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill directs the agent to run git checkout -- . when the user chooses Reject. This discards all tracked working-tree changes, including unrelated work.
High
SKILL.md:4
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch frontmatter automatically downloads executable diff_analyzer.py from the mutable main branch without a commit pin or integrity check.
High
SKILL.md:6
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch frontmatter automatically downloads executable impact_mapper.py from the mutable main branch without a commit pin or integrity check.
High
SKILL.md:8
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch frontmatter automatically downloads executable report_generator.py from the mutable main branch without a commit pin or integrity check.
High
SKILL.md:10
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch frontmatter automatically downloads executable lang.py from the mutable main branch without a commit pin or integrity check.
High
SKILL.md:12
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch frontmatter automatically downloads executable commit_guard.py from the mutable main branch without a commit pin or integrity check.
High
SKILL.md:14
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch frontmatter automatically downloads executable install_hook.sh from the mutable main branch without a commit pin or integrity check.
Medium
scripts/impact_mapper.py:382
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT controls additional scan roots and accepts absolute paths. A configured value can expand file inspection beyond the current project.
Medium
scripts/install_hook.sh:29
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json and creates the hidden configuration directory. This persists a command hook in the user's project.
Medium
scripts/install_hook.sh:66
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites settings.local.json to register a future command hook. Existing settings are parsed and preserved, but the persistent configuration change is security relevant.
Medium
SKILL.md:16
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch frontmatter downloads mutable analysis rules without a commit pin or integrity check. Altered rules can change reported impact and agent decisions.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:349-384
Prompt Injection Attempt Detected
The skill states, "AI knows it's authorized to fix all consumers," and, "Do not ask the user per-consumer." This expands one approval into broad repository modification authority.
The cited section explicitly grants broad scope and suppresses further confirmation. The language directly changes the agent's authorization behavior.
RISK-002 Medium
scripts/commit_guard.py:154-156scripts/report_generator.py:456-458
Fixed Report Path Can Overwrite Project Data
The analyzer writes conflict-report.md to the project root without checking whether the file already exists. Repeated runs can replace unrelated user content.
Both locations use a fixed filename and direct write operations with no existence check, backup, or alternate output path.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Executable companion files are fetched automatically from a mutable branch.
    Pin every fetch URL to an immutable commit and verify a published checksum before loading or execution.
  2. FIX-002
    High
    The --since value can be interpreted as a Git option.
    Validate the value with git rev-parse, reject option-like inputs, disable external diff behavior, and separate revisions from paths explicitly.
  3. FIX-003
    High
    Frontend discovery can scan sibling or absolute directories outside the selected repository.
    Restrict scans to the repository root by default and require explicit approval for each additional normalized path.
  4. FIX-004
    High
    The Reject workflow uses git checkout -- . and can discard unrelated work.
    Show a scoped change preview, preserve unrelated files, create a backup, and require explicit confirmation before any restore command.
  5. FIX-005
    High
    The skill grants itself authority to modify every detected consumer without further confirmation.
    Present the exact file list and planned edits, then require explicit scope approval before changing files outside the original request.
  6. FIX-006
    Medium
    Hook installation and report generation modify fixed project paths.
    Preview configuration changes, preserve existing hooks, support uninstall automation, and avoid overwriting conflict-report.md without confirmation or versioning.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable