Release Skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:40 PM UTC
• Version: 0.1.0

Overview

This is a disclosed release-helper skill, but its broad install/activation and high-impact git workflow need Review before installation.

Review this skill before installing, especially if you use global skill directories. Prefer installing from a pinned trusted commit or release, run dry-run/preview first, and only allow commit, tag, or push actions after checking the exact repository, branch, files, and version being changed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:26

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, line 26
Vulnerability Type: Supply-chain risk through unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

bash

npx add https://github.com/wpank/ai/tree/main/skills/tools/release-skills

Technical Analysis

The documented installation command uses npx to resolve and execute the npm package named add. The command does not pin that package to a reviewed version or verify its integrity. Execution therefore depends on package-registry content that can change after this project has been audited.

The Skill source is also referenced through a mutable GitHub branch path. Branch content may change over time, so the installed files are not guaranteed to correspond to the audited revision. The combination of an executable, unpinned npm package and mutable remote source creates an installation-time supply-chain trust boundary that is not protected by version or integrity verification.

This issue is in the installation documentation rather than the bundled Python scripts. The reviewed scripts themselves use Python's standard library and do not fetch or execute remote payloads.

Attack Path

1. An attacker compromises the npm package resolved as add, one of its dependencies, or the associated publisher account. Alternatively, an attacker gains control of the mutable upstream branch or its repository.
2. The attacker publishes malicious installation logic or substitutes malicious Skill content.
3. A user follows the documented npx add ... command.
4. npx downloads and executes the currently resolved package code without validating it against an audited version or expected integrity hash.
5. The malicious package executes with the privileges of the user running the installation command and may install altered Skill files or perform unrelated system actions.

Impact Assessment

Successful exploitation permits arbitrar ...[truncated 520 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned npx add invocation with an installer whose package name and exact version are explicitly pinned.
2. Pin the Skill source to an immutable Git commit or signed release tag instead of a mutable branch path.
3. Publish and verify cryptographic checksums or signatures for downloaded release artifacts.
4. Prefer a non-executing installation method, such as downloading a versioned archive, verifying its checksum, and copying the reviewed files into the destination.
5. If an npm-based installer remains necessary, lock all transitive dependencies, review package lifecycle scripts, and document the expected package publisher and integrity value.
6. In CI environments, run installation with minimal permissions, no unnecessary secrets, and restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code is clearly release-preparation related, so the high-level domain matches. However, the description materially overstates capabilities. The script handles version bumping, lightweight validation, changelog generation, and release summaries for skill directories. It uses git only to discover repo root, inspect existing tags, and collect commit messages since a tag. It does not create or apply git tags, does not push to remote, does not publish a release, and does not prepare deployments. The 'multi-language changelogs' claim is unsupported; the changelog is generated in one fixed markdown structure with English section names. 'Auto-detection' and 'universal' are also overstated because execution is manual via CLI flags and targeted specifically at skills under .agents/skills. Therefore this is a description-behavior mismatch due to multiple undeclared/overclaimed primary capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a broad release automation workflow: detecting changes, bumping versions, updating changelogs, tagging, pushing, and preparing releases. The supplied code does only one narrow part of that story: it reads skill metadata and git logs, then formats aggregated release notes. It does not modify repository state, bump versions, write changelog files, create tags, push to remotes, or implement semantic versioning. While release notes generation is related to release workflows, the primary purpose and capabilities are materially narrower than declared, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code’s real scope is narrow: changelog generation from completed roadmap/TODO items and optional insertion into CHANGELOG.md. That is related to releases, but it does not implement the broader declared workflow features such as semantic versioning, git tagging, pushing, release creation, deployment preparation, or auto-detection. The description materially overstates the skill’s capabilities and primary purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

| `scripts/prepare_release.py` | Prepare release with version bump |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

| `scripts/release_notes.py` | Generate release notes from commits |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The skill is designed for release operations and explicitly persists as an installable capability that can be triggered by broad phrases including push and release. In an agent context, that persistence plus ambiguous activation increases the risk of accidental invocation of sensitive actions affecting versioning, changelogs, tags, or deployment preparation across future sessions.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

## When to Use

- User wants to create a release or bump a version
- Updating changelogs before a deploy
- Preparing for deployment with proper tagging
- Triggered by: "release", "new version", "bump version", "update version", "push", "create release", "prepare release", "tag version"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The listed trigger phrases are broad terms like release, push, and update version, which can overlap with normal conversational or development requests. In an agent environment, this increases the chance of unintended activation of a workflow that can modify files, changelogs, tags, or release state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install the skill via npx add from a remote GitHub URL without any pinned version, tag, or commit digest. That creates a supply-chain risk: future upstream changes or a compromised repository could cause users to fetch unexpected code or content during installation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/release-skills .claude/skills/release-skills

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/release-skills .claude/skills/release-skills

Claude Code (global)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/release-skills ~/.claude/skills/release-skills

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/release-skills ~/.claude/skills/release-skills

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes shell execution, file reads/writes, and environment access but does not declare any explicit tool scope or permissions boundaries. In a release workflow, these capabilities can modify repository state, create commits/tags, and push to remotes, so missing scope declarations increases the risk of over-privileged or unintended execution.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: release-skills
model: fast
description: |
  WHAT: Universal release workflow with auto-detection, multi-language changelogs, semantic versioning, and git tagging.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords include broad terms like "release," "push," and "new version," which can cause unintended invocation in ordinary conversations. Because this skill includes repository-modifying and push-related steps, accidental activation could lead to inappropriate suggestions or execution attempts in a sensitive development context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md

## NEVER

- Force push to main/master
- Skip user confirmation before push
- Create tags without commits
- Include internal/chore changes in user-facing changelog
- Push without explicit user consent

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_release.py (reported line 116)May include surrounding context.

python

patterns = [f"{skill_name}/v*", f"{skill_name}-v*", "v*"]
    for pattern in patterns:
        try:
            out = subprocess.check_output(
                ["git", "tag", "-l", pattern, "--sort=-v:refname"],
                stderr=subprocess.DEVNULL, text=True
            ).strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_release.py (reported line 102)May include surrounding context.

python

def git_root() -> Path:
    """Find the repository root."""
    try:
        out = subprocess.check_output(
            ["git", "rev-parse", "--show-toplevel"],
            stderr=subprocess.DEVNULL, text=True
        ).strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_notes.py (reported line 71)May include surrounding context.

python

def git_root() -> Path:
    """Find the repository root."""
    try:
        out = subprocess.check_output(
            ["git", "rev-parse", "--show-toplevel"],
            stderr=subprocess.DEVNULL, text=True
        ).strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_release.py (reported line 134)May include surrounding context.

python

if path:
        cmd.extend(["--", path])
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
    except (subprocess.CalledProcessError, FileNotFoundError):
        return []
    if not out:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_notes.py (reported line 90)May include surrounding context.

python

if path:
        cmd.extend(["--", path])
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
    except (subprocess.CalledProcessError, FileNotFoundError):
        return []
    if not out:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_notes.py (reported line 106)May include surrounding context.

python

def file_added_after(filepath: Path, since: str) -> bool:
    """Check if a file was first added to git after the given date."""
    try:
        out = subprocess.check_output(
            ["git", "log", "--diff-filter=A", "--format=%aI",
             "--follow", "--", str(filepath)],
            stderr=subprocess.DEVNULL, text=True

Tainted flow: 'updated' from pathlib.Path.read_text (line 329, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/roadmap_changelog.py (reported line 331)May include surrounding context.

python

else:
        updated = content.rstrip("\n") + "\n\n" + new_section

    changelog_path.write_text(updated)


# ---------------------------------------------------------------------------

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs a write to the changelog file via write_text(), creating or modifying CHANGELOG.md when --append is used. Although the CLI help mentions append behavior, the write path itself has no confirmation prompt and no inline comment/docstring warning near the destructive file-modification operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.