Versioned security assessment

Report ID: SA-B68376BB

7/1/2026, 3:41:15 AM

finishing-a-development-branch security assessment v3

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: finishing-a-development-branch
Version: v3
Maintainer: ZhanlinCui
Source: github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/finishing-a-development-branch
Coverage: 1 Files scanned · 201 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged many shell command examples and two false-positive weak crypto detections. Review found legitimate Git and test workflow commands, but the skill can change repository state, push branches, create pull requests, and delete branches or worktrees after confirmation.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 201 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 6 evidence locations

Capability review items (2)

Medium

SKILL.md:70-84 SKILL.md:91-103 SKILL.md:129-131 SKILL.md:141-147

Repository-Modifying Shell Workflow

The skill instructs agents to run Git and project test commands that can switch branches, pull changes, merge a branch, push to origin, create a pull request, delete a feature branch, and remove a worktree. These actions match the skill purpose and include a typed confirmation before forced deletion, but they can alter local and remote repository state.

The listed commands are explicit and semantically aligned with branch completion. Risk is from legitimate repository mutation and deletion, not from evidence of malicious intent.

Low

SKILL.md:96-103 SKILL.md:142

Shell Command Substitution in Examples

The pull request command uses command substitution to pass a heredoc body to the GitHub CLI, and the worktree check substitutes the current branch name into grep. These are common shell patterns, but unreviewed placeholder replacement or unusual branch names could cause incorrect command behavior.

The command substitutions are visible in shell examples and appear operational rather than malicious. The concern is limited to robustness and safe quoting.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)

Low

SKILL.md:3

False Positive: Weak Cryptographic Algorithm

Static analysis reported weak cryptography at the metadata description line, but that line only describes development workflow completion. No cryptographic algorithm or security-sensitive hashing logic is present in the reviewed file.

The reviewed line contains descriptive prose only. I found no evidence of MD5, SHA-1, DES, or other weak cryptographic use in SKILL.md.

Low

SKILL.md:44

False Positive: Standard Device File Redirect

Static analysis flagged access to /dev/null in the merge-base command. The redirect only suppresses command error output while checking common base branches and does not read or modify user files.

The /dev/null references are standard shell redirection in a Git branch detection command. No evidence found of sensitive filesystem access or persistence.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable