Versioned security assessment

Report ID: SA-EBDFE608

7/23/2026, 7:06:04 PM

github-release-management security assessment v8

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
github-release-management
Version
v8
Maintainer
ruvnet
Source
github.com/ruvnet/claude-flow/tree/main/.claude/skills/github-release-management
Coverage
1 Files scanned · 1,065 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most alerts are false positives from Markdown fences, quoted substitutions, documentation URLs, and relative links. Six static findings remain for shared temporary files and persisted release credentials. Additional risks include mutable package execution, untrusted metadata entering AI generation, and emergency gate bypasses.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 1,065 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 6 evidence locations

Filesystem access

May read or write local files.

Observed in 6 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (5)
High
SKILL.md:699
Git platform tokens
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
The workflow expands GITHUB_TOKEN into a shell pipeline and persists gh authentication before executing mutable npm tooling. Step-scoped GH_TOKEN access would reduce credential exposure.
Medium
SKILL.md:719
Temp directory access
echo "$PRS" > /tmp/release-prs.json
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
SKILL.md:720
Temp directory access
echo "$COMMITS" > /tmp/release-commits.txt
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
SKILL.md:726
Temp directory access
--prs "$(cat /tmp/release-prs.json)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.
Medium
SKILL.md:727
Temp directory access
--commits "$(cat /tmp/release-commits.txt)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
SKILL.md:778
NPM config file (may contain tokens)
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
The workflow writes NPM_TOKEN in plaintext to repository-root .npmrc, then builds Docker context from that directory. Without exclusion and cleanup, later steps can expose the token.
RISK-002 High
SKILL.md:716SKILL.md:725SKILL.md:748SKILL.md:758SKILL.md:791
Mutable Package Execution in a Privileged Release Job
The workflow repeatedly executes claude-flow@alpha after storing GitHub credentials and, later, while a token-bearing .npmrc exists.
The commands run a mutable npm prerelease in a privileged job. Package compromise could expose repository or registry credentials.
RISK-003 Medium
SKILL.md:708-727
Untrusted Repository Metadata Enters AI Changelog Generation
PR titles and commit messages enter AI-driven changelog generation without trust boundaries, validation, or instructions to ignore embedded directives.
The data flow is explicit, and the skill describes intelligent changelog generation. The downstream tool behavior is unavailable, which limits certainty.
RISK-004 Medium
SKILL.md:400-410SKILL.md:847-853
Emergency Release Flow Bypasses Normal Gates
Emergency commands recommend bypassing checks and fast-tracking publication, which can deploy insufficiently tested changes when labels or issue context are misused.
The bypass and fast-track flags are explicit in release examples. Their exact enforcement depends on the external Claude Flow implementation.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Mutable claude-flow@alpha packages execute during privileged release steps.
    Pin an audited version and integrity through the lockfile, invoke the local binary, and isolate generation from publishing credentials.
  2. FIX-002
    High
    The npm token is written to repository-root .npmrc before a Docker build.
    Use step-scoped NODE_AUTH_TOKEN, remove .npmrc immediately after publishing, and exclude credential files from every Docker build context.
  3. FIX-003
    High
    GitHub authentication is persisted before third-party package execution.
    Provide GH_TOKEN only to required steps, avoid gh auth login in CI, and reduce workflow permissions to each operation.
  4. FIX-004
    Medium
    Release metadata uses predictable shared temporary paths.
    Create private files with mktemp, restrict permissions, verify ownership, and remove them with a trap after use.
  5. FIX-005
    Medium
    Repository-controlled text enters AI changelog generation.
    Treat PR and commit text as untrusted data, delimit it clearly, disable tool execution, and require human review before publication.
  6. FIX-006
    Medium
    Emergency examples bypass normal release validation.
    Keep mandatory security and smoke tests, require protected-environment approval, and limit fast-track activation to authorized maintainers.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Content hash
e3467ff559be1dcffe508b576c395125a0da84b01791f65c3e0ac5aceb366b1d
Tree hash
0390ead7166f6d67fe6c3a3864f64382fd2ed9bcb4a69c52ab319b4bb5b4e9c1
Skill path
skills/ruvnet/github-release-management
Audit payload hash
8a4c2694eb61b21e7c1dc2c5557df5c9

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active