Versioned security assessment

Report ID: SA-EBDFE608

7/23/2026, 6:54:39 PM

github-multi-repo security assessment v8

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
github-multi-repo
Version
v8
Maintainer
ruvnet
Source
github.com/ruvnet/claude-flow/tree/main/.claude/skills/github-multi-repo
Coverage
1 Files scanned · 863 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives from Markdown fences, template delimiters, documentation links, and expected webhook secret access. Confirmed risks involve predictable shared temporary paths and unisolated npm execution. Broad multi-repository writes also lack explicit approval gates.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 863 Lines analyzed

20 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 17 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 55 evidence locations

Capability review items (18)
High
SKILL.md:429
Shell command substitution
cd /tmp/$(basename $repo .json | sed 's/audit-//')
The working directory is derived from an untrusted shared /tmp filename without validation. Directory planting can redirect later npm and git operations.
High
SKILL.md:102-118
Template literal with command substitution
Bash(`cat /tmp/repos.txt | while read -r repo; do
The Bash block clones repositories and runs npm update and npm test without isolation. Repository lifecycle and test scripts execute with the agent's credentials.
High
SKILL.md:427-440
Template literal with command substitution
Bash(`for repo in /tmp/audit-*.json; do
The Bash loop trusts shared /tmp audit files, then runs npm audit fix and npm test in derived directories. Planted files can redirect code execution.
High
SKILL.md:104
Temp directory access
cd /tmp/$repo
The script enters a predictable /tmp directory without checking clone success, then runs npm commands. Directory planting can cause arbitrary local script execution.
High
SKILL.md:369
Temp directory access
cd /tmp/$repo
The workflow enters a predictable /tmp directory without checking clone success, then runs npm install and tests. A planted directory can execute scripts.
High
SKILL.md:422
Temp directory access
cd /tmp/$repo
The workflow enters a predictable /tmp directory without verifying the clone, then invokes npm. A planted directory can redirect subsequent execution.
High
SKILL.md:427
Temp directory access
Bash(`for repo in /tmp/audit-*.json; do
The patch loop trusts every file matching a shared /tmp glob. An attacker can plant an audit file and corresponding directory to trigger npm execution.
High
SKILL.md:429
Temp directory access
cd /tmp/$(basename $repo .json | sed 's/audit-//')
The patch directory is derived from a shared temporary filename without validation. Directory planting can redirect npm and git mutations.
Medium
SKILL.md:428
Shell command substitution
if [ $(jq '.vulnerabilities | length' $repo) -gt 0 ]; then
The jq substitution consumes an unquoted filename selected from a shared /tmp glob. A planted filename can alter audit processing and patch decisions.
Medium
SKILL.md:180-184
Template literal with command substitution
Bash(`gh api repos/:owner/:repo/contents/claude-code-flow/CLAUDE.md \
The helper uploads content read from a predictable shared temporary file. Another local process can replace that content before publication.
Medium
SKILL.md:99
Temp directory access
--jq '.[] | select(.name | test("-service$")) | .name' > /tmp/repos.txt`)
The command overwrites the predictable shared path /tmp/repos.txt. A symlink or concurrent run can redirect or corrupt the repository list.
Medium
SKILL.md:102
Temp directory access
Bash(`cat /tmp/repos.txt | while read -r repo; do
The workflow trusts repository names read from predictable /tmp/repos.txt. Another process can alter the list before cloning and mutation.
Medium
SKILL.md:103
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Repositories are cloned into predictable shared /tmp directories without exclusive creation. Existing directories or concurrent runs can alter workflow behavior.
Medium
SKILL.md:177
Temp directory access
--jq '.content' | base64 -d > /tmp/claude-source.md`)
Redirection writes to predictable /tmp/claude-source.md. A symlink can redirect the write, and another process can replace the synchronized content.
Medium
SKILL.md:184
Temp directory access
-f content="$(cat /tmp/claude-source.md | base64)"`)
The GitHub update reads from predictable /tmp/claude-source.md. Local tampering can publish unauthorized documentation content.
Medium
SKILL.md:368
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Repositories are cloned into predictable shared /tmp directories without collision handling. A concurrent or planted directory can affect the update workflow.
Medium
SKILL.md:421
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Security scans clone repositories into predictable shared /tmp directories. The workflow does not prevent collisions or planted directories.
Medium
SKILL.md:423
Temp directory access
npm audit --json > /tmp/audit-$repo.json
Audit output is written to a predictable shared /tmp filename. Symlinks, stale files, or concurrent runs can corrupt later patch decisions.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:102-118SKILL.md:367-389SKILL.md:419-440
Unisolated execution of repository scripts
Bulk workflows run npm update, install, audit fixes, and tests from cloned repositories. Package lifecycle or test scripts receive the agent environment and credentials.
The cited workflows explicitly clone repositories and invoke npm commands without a sandbox, restricted environment, or disabled lifecycle scripts.
RISK-002 Medium
SKILL.md:110-117SKILL.md:148-157SKILL.md:367-389SKILL.md:427-440
Broad repository mutations lack approval gates
Examples create branches, upload files, install dependencies, push commits, and open pull requests across repository sets without an explicit review or confirmation step.
The documented flows perform write operations immediately after tests or scans. No dry run, change preview, or user approval gate is shown.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Repository package and test scripts run with the agent environment.
    Use isolated containers, minimal tokens, repository allowlists, and restricted environment variables. Disable lifecycle scripts when they are unnecessary.
  2. FIX-002
    High
    Workflows reuse predictable files and directories under shared /tmp.
    Create private temporary directories with mktemp, quote every path, stop after clone failures, verify ownership, and remove temporary data with traps.
  3. FIX-003
    Medium
    Bulk GitHub mutations proceed without an explicit approval checkpoint.
    Add dry runs and change summaries. Require user confirmation before API writes, dependency changes, commits, pushes, or pull request creation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Content hash
4bffcdde56dde22ccea63322360588fd718e780a34f9f476bf8bca9c748b2401
Tree hash
255ad69414d58018069f611ee74b6d2be5288d2cddc4fa7852518e97e71d04d4
Skill path
skills/ruvnet/github-multi-repo
Audit payload hash
6c4c6d18ded5dd30efea3d5ecfcaa303

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active