This report does not block or authorize the manifest or ZIP.
Static analysis found many command-execution patterns, but review shows they are documented shell and MCP examples for GitHub project management rather than hidden executable code. No prompt injection, hardcoded credential exfiltration, or malicious network endpoint was found. The skill still carries medium risk because it directs agents to run local scripts, read local planning files, and sync project data with GitHub, Jira, and Slack.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
2 Files scanned · 710 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The skill contains many examples that instruct agents to run npx, bash scripts, and MCP-style commands for project automation. This appears intentional for a GitHub project management skill, but execution can mutate repositories, milestones, labels, releases, and project boards if used without review.
The command examples are explicit and repeated, so the capability is real. The context is legitimate project automation, so this is operational risk rather than confirmed malicious behavior.
External Service Synchronization Can Share Project Data
The skill describes bidirectional Jira synchronization and Slack webhook notifications. No hardcoded exfiltration endpoint was found, but project metadata, issue details, and milestone status could be sent to third-party systems configured by the user.
The external integrations are clearly documented and use placeholders rather than hidden endpoints. The data-sharing risk depends on user configuration and repository sensitivity.
A milestone creation example uses shell command substitution to read a local release plan into a GitHub milestone description. This is a reasonable workflow, but it can publish local planning content to GitHub if the file contains sensitive information.
The shell substitution is visible and tied to a local release-plan file. It is not obfuscated, but it can disclose local file contents to GitHub by design.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static analysis flagged weak cryptographic algorithm patterns at several lines, but the reviewed lines contain descriptive project-management text, claude-flow alpha package references, or a shell example. No cryptographic implementation was found.
Line review shows no MD5, SHA-1, DES, RC4, or similar cryptographic use. The alerts are keyword collisions in ordinary documentation and command examples.
Static analysis flagged reconnaissance in the skill and diagram, but the reviewed lines describe team size, sprint flow, and risk identification in a project-management process. No host, network, or system enumeration instructions were found.
The cited lines are project-management prose and graph edges. They do not instruct scanning hosts, probing networks, or collecting system information.