Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

fullstack-guardian

skill:jeffallan/claude-skills#fullstack-guardian

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.

skills.shSkillsMP
Verdict
Malicious

Confirmed harmful behavior that reaches the agent or host.

Analyzed Oct 27, 2026, 21:30 UTC at 190e05a

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

24
findings
critical
highest severity
5
threat classes
590
files scanned
3,786/3,786
checks satisfied
0
package advisories

Why this verdict

  • malicious: finding skill:skills/fullstack-guardian:research/SKILL_TRIGGER_LOGS.md:22:PERSIST passes reach/harm/chain at critical

Security findings 24

Persistence

criticalConfirmedhigh confidence

The research documentation shipped with the skill instructs adding UserPromptSubmit and PreToolUse hooks to ~/.claude/settings.json that append every user prompt (with working directory) and every SKILL.md/reference file read to ~/.claude/logs/skill-triggers.log, persisting a surveillance hook into the agent control plane, which is far beyond the skill's declared full-stack web development purpose.

research/SKILL_TRIGGER_LOGS.md:22-53
Add to `~/.claude/settings.json`
vector:instructionvector:mixed
Counter-argument considered

The doc instructs pasting UserPromptSubmit/PreToolUse hooks into ~/.claude/settings.json that append every user prompt with working directory and every SKILL.md/reference read to a persistent log outside the workspace, a host-config write and surveillance capability far outside the declared full-stack description; it is not a validated hook shim with safe cleanup or any other carve-out, so the true-positive finding stands.

Code execution

highContextual risklow confidence

The project workflow ingests remote Confluence pages as machine-readable JSON ticket data that drives Jira ticket creation, and /execute-ticket then fetches those Jira tickets and follows their embedded implementation steps against the codebase, so tampered remote document or ticket content could steer code changes; every stage is mediated by explicit user-confirmation checkpoints, so intent and exploitability are not established.

commands/project/discovery/synthesize-discovery.md:311
*This section is machine-readable and used by `/approve-synthesis` command.*
vector:instruction
Counter-argument considered

The synthesis section is explicitly machine-readable input to /approve-synthesis and execute-ticket declares ticket implementation steps the primary source of truth for code changes, so the remote-content-to-code chain exists; user checkpoints mitigate but the finding already credits them and they do not neutralize injected content.

Persistence

highContextual riskmedium confidence

The complete-epic retrospective instructs the agent to persistently write to its own agent instruction files (CLAUDE.md and AGENTS.md) whenever it judges that new commands, workflows, or coding standards were established, which can alter future agent behavior outside the reviewed task.

commands/project/retrospectives/complete-epic.md:333
Update CLAUDE.md if new commands or workflows were created
vector:instruction
Counter-argument considered

Phase 5 directs the agent to edit its own instruction files based on its own judgment, with no user-approval checkpoint shown for these writes and no declared claim covering them, so future-behavior-altering persistence is established.

Persistence

highContextual riskmedium confidence

The setup guide instructs creating or updating the agent MCP configuration file .mcp.json in the project root so Claude Code launches the third-party mcp-atlassian Docker container with the project's Atlassian credential env file attached.

docs/ATLASSIAN_MCP_SETUP.md:158-179
Create or update `.mcp.json` in your project root
vector:instruction
Counter-argument considered

The guide instructs writing the agent's MCP configuration that auto-launches the third-party mcp-atlassian container with the credential env file attached; wiring an unpinned third-party container into the agent control plane is not a carved-out vendor installer and no declared claim legitimizes it.

Credential access

highContextual risklow confidence

The troubleshooting guide instructs setting CONFLUENCE_SSL_VERIFY=false and JIRA_SSL_VERIFY=false for self-signed certificates while the same env file carries Atlassian API tokens, so those tokens can be transmitted over unverified TLS connections.

docs/ATLASSIAN_MCP_SETUP.md:292-342
CONFLUENCE_SSL_VERIFY=false
vector:instruction
Counter-argument considered

The troubleshooting steps set both SSL_VERIFY variables to false while the same env file carries Atlassian API/personal tokens, so tokens can transit unverified TLS; this is operational guidance rather than a carved-out category and the exposure consequence is undeclared.

Persistence

highContextual riskmedium confidence

The setup checklist instructs creating `.mcp.json` agent MCP configuration wiring a third-party Docker MCP server into the agent control plane — undeclared residue R2 (unexplained: nothing hides it), which the skill's declared full-stack web development purpose does not cover; the contradiction pairing against the common-ground/Jira read-only claims (C36) is not confirmed because writing local MCP config breaks none of those scoped claims.

docs/ATLASSIAN_MCP_SETUP.md:459
- [ ] `.mcp.json` created with Atlassian configuration
vector:instruction
Counter-argument considered

The checklist step persists an agent-level MCP configuration registering the unpinned third-party container for every session; a host agent-config write is not covered by any declared capability of matching kind or by a carve-out, so the persistence surface stands even though the credential aspect (F14) is carved out.

Persistence

highContextual riskmedium confidence

The Quick Start section directs running Makefile targets dev-link/dev-unlink that re-link the agent's plugin cache to the working copy, an undeclared modification of the plugin load path whose implementing Makefile is not shown in this batch.

docs/local_skill_development.md:10
make dev-link    # Link your working copy to the plugin cache
vector:instruction
Counter-argument considered

The doc directs running dev-link/dev-unlink, which it itself describes as linking the working copy into the plugin cache the CLI loads at session start — an undeclared modification of the agent's load path (detector residue flags the equivalent cache writes as declared nowhere) outside any carve-out; the shown manual equivalents (mv + ln -s) establish the sink, so the unshown Makefile is not needed to complete the analysis.

Persistence

highContextual risklow confidence

The local skill development guide instructs symlinking the Claude Code plugin cache directory (~/.claude/plugins/cache/<plugin>/<name>/<version>) to an arbitrary working copy so the agent loads whatever content is placed there at session start, with move/symlink commands in the doc and a quick-reference script and restore steps included.

docs/local_skill_development.md:34
Symlink the cache directory to your working copy so edits are immediately available on CLI restart.
vector:instruction
Counter-argument considered

The guide explicitly instructs symlinking the plugin cache directory to the working copy so the CLI loads that content on restart; detector residue records the cache writes as not declared anywhere, the declared description covers none of this, and the concrete ln -s instruction supplies the chain, so the finding stands as contextual risk.

Credential access

highContextual riskmedium confidence

The guide instructs reading the agent configuration file ~/.claude/plugins/installed_plugins.json to extract the plugin cache install path used by the symlink workflow.

docs/local_skill_development.md:41
cat ~/.claude/plugins/installed_plugins.json | grep installPath
vector:instruction
Counter-argument considered

The guide gives a concrete command reading the agent's installed_plugins.json to extract the cache install path; reading agent-home configuration is outside every carve-out and detector residue records the read as declared nowhere, so the CRED finding survives as contextual risk.

Persistence

highContextual risklow confidence

The local development guide instructs moving the installed plugin snapshot at ~/.claude/plugins/cache/<plugin>/<name>/<version> to a backup and symlinking that path to an arbitrary working copy, redirecting the code and instructions the agent CLI loads at session start.

docs/local_skill_development.md:52-58
~/.claude/plugins/cache/<plugin>/<name>/<version>.bak
vector:instruction
Counter-argument considered

The doc instructs moving the installed plugin snapshot to a .bak inside the agent's plugin cache as the setup step for replacing the load path with a symlink; the write is explicit, detector residue marks this exact capability as not declared anywhere, and no carve-out covers it.

Persistence

highContextual riskmedium confidence

The plugin's documentation instructs backing up the installed Claude Code plugin cache directory and replacing it with a symlink to an arbitrary local working copy (and later removing/restoring it), an undeclared write to the agent's plugin-loading path that the fullstack-guardian skill description does not cover; it is openly documented with revert steps, so it is unexplained rather than concealed residue.

docs/local_skill_development.md:64
ln -s /path/to/your/working/copy
vector:instruction
Counter-argument considered

Transparency and restore steps temper severity but do not clear the gates: replacing the installed plugin cache path with a symlink to an arbitrary working copy redirects what the CLI loads at session start, the detector records these cache writes as declared nowhere, and the skill description covers none of it, so the undeclared finding stands.

Credential access

highContextual riskmedium confidence

The v0.5.0 plan instructs every workflow command to read the consumer project's agent-side configuration file `.claude/workflow-config.json` at a Phase 0 step, a capability undeclared in the fullstack-guardian skill description though openly documented for backend selection (residue R9, adjudicated unexplained).

docs/v0.5.0-plan.md:41
Read .claude/workflow-config.json (default: local/local)
vector:instruction
Counter-argument considered

The plan concretely instructs every command's Phase 0 to read the consumer project's .claude/workflow-config.json; detector residue records this file read as declared nowhere and the fullstack-guardian description does not cover agent-side config reads, so the CRED finding survives.

Credential access

highContextual riskmedium confidence

The common-ground reference documentation instructs the agent to locate, read, and maintain state files under ~/.claude/common-ground/ (global index, per-project ground files, machine index), which is undeclared residue relative to the target's stated full-stack development purpose, though it is openly documented self-state access with no concealment.

references/common-ground/file-management.md:62
Located at: `~/.claude/common-ground/index.md`
vector:instruction
Counter-argument considered

The shipped reference file explicitly directs the agent to read, create, and update state under ~/.claude/common-ground/ (global index, ground files, machine index), exactly as claimed; this scope appears nowhere in the declared full-stack description and no carve-out or mitigation covers it, with the open documentation the claim concedes keeping this low-severity contextual risk intact.

Persistence

highContextual riskmedium confidence

The skill instructs the agent to create and maintain cross-session state files under the agent's own configuration home (~/.claude/common-ground/), persisting agent-readable assumption data outside the workspace beyond the declared full-stack development task.

references/common-ground/file-management.md:8
Ground files are stored in the user's Claude home directory:
vector:instruction
Counter-argument considered

The file instructs storing ground files in the user's Claude home and gives concrete create/update steps that persist cross-session state outside the workspace; the declared full-stack description never declares this persistence, and no carve-out or mitigation neutralizes it, so the finding stands.

Code execution

highContextual risklow confidence

The document instructs piping jq-generated gh label create commands read from labels.json directly into bash, executing that file's content as shell code if it is altered or supplied by another party.

research/GITHUB_ISSUE_TREE.md:210-236
' | bash
vector:instruction
Counter-argument considered

The shipped research doc contains a concrete pipeline that pipes jq-derived strings from labels.json straight into bash, executing whatever that file contains as shell commands; no declaration or mitigation covers the pipe-to-bash pattern, so the low-severity contextual finding survives even though the doc itself supplies the initial benign content.

Credential access

highContextual risklow confidence

Undeclared analysis and test scripts read the agent-home files ~/.claude/logs/skill-triggers.log and ~/.claude/tests/skill-trigger-tests.json and write results under ~/.claude/logs, extending a skill-usage monitoring capability that the declared full-stack development purpose does not declare; the paths are the system's own logs and fixtures rather than credential stores, so the credential characterization is weak.

research/SKILL_TRIGGER_LOGS.md:182
LOG=~/.claude/logs/skill-triggers.log
vector:instruction
Counter-argument considered

The doc's analysis and test scripts do read ~/.claude/logs/skill-triggers.log and ~/.claude/tests/skill-trigger-tests.json and write results under ~/.claude/logs, a skill-monitoring capability absent from the declared description; as the claim itself concedes, the paths are the system's own logs and fixtures rather than credential stores, so the behavior stands only as weak, low-severity undeclared residue and is not refuted.

Supply chain

mediumContextual riskmedium confidence

The plugin marketplace manifest pins plugin distribution to the mutable GitHub branch ref `plugin` instead of a tag or commit hash, an unpinned remote-code source the declared full-stack implementation purpose does not require, so a moved or compromised branch would be pulled as a trusted plugin update.

.claude-plugin/marketplace.json:16
ref: plugin
vector:metadata
Counter-argument considered

The manifest verifiably pins plugin distribution to the mutable named ref 'plugin' rather than a tag or commit; this is not a pinned-registry install, and no declared claim covers distribution pinning, so the contextual supply risk stands.

Supply chain

mediumContextual risklow confidence

The marketplace manifest installs the plugin from the mutable branch ref 'plugin' of jeffallan/claude-skills rather than a pinned tag or commit, so the code the agent runs can change silently between installs.

.claude-plugin/marketplace.json:9
plugins[0].source.ref: plugin
vector:metadata
Counter-argument considered

Same observable as F1: the decoded manifest shows the plugin source ref set to the mutable branch name 'plugin', so installed code can change silently between installs; nothing in the evidence pins it or declares it acceptable.

Supply chain

mediumContextual riskmedium confidence

commands/workflow-manifest.yaml, consumed at runtime, declares an external prerequisite skill feature-forge for the discovery phase that is not shown to be shipped by this artifact, so the workflow would load whatever provides that skill at runtime.

commands/workflow-manifest.yaml:23
- skill: feature-forge
vector:instruction
Counter-argument considered

The runtime manifest names feature-forge as a discovery-phase prerequisite with no shown source and no shipped copy in the evidence, so a consuming workflow would resolve it to whatever provides that skill at runtime; the claim's hedge matches the shown manifest.

Supply chain

mediumContextual riskmedium confidence

The setup guide has the user pull and run the mutable unpinned tag ghcr.io/sooperset/mcp-atlassian:latest and wire it into agent MCP config and docker test commands, so whatever the tag resolves to at pull time executes with the user's Atlassian credentials, a risk the artifact's own audit doc acknowledges.

docs/ATLASSIAN_MCP_SETUP.md:158-179
ghcr.io/sooperset/mcp-atlassian:latest
vector:instruction
Counter-argument considered

The credential-carrying container is pulled and wired in pinned only to the mutable :latest tag, and the artifact's own audit doc calls the missing pinning guidance risky, so the unpinned remote-code surface stands undeclared and unmitigated.

Supply chain

mediumUnverifiedmedium confidence

The Atlassian MCP setup guide instructs users to pull and run the third-party image ghcr.io/sooperset/mcp-atlassian:latest pinned only to the mutable :latest tag, and the .mcp.json template injects Atlassian API credentials into that unpinned image via --env-file .env.local.

docs/ATLASSIAN_MCP_SETUP.md:180-187
docker pull ghcr.io/sooperset/mcp-atlassian:latest
vector:instruction

Supply chain

mediumContextual riskmedium confidence

Setup documentation pins the Atlassian integration to the mutable `:latest` tag of the third-party image `ghcr.io/sooperset/mcp-atlassian`, so the code that receives the stored Atlassian credentials can silently change; this unpinned remote code surface is undeclared for the skill's stated purpose.

docs/ATLASSIAN_MCP_SETUP.md:460
- [ ] Docker image pulled: `docker pull ghcr.io/sooperset/mcp-atlassian:latest`
vector:instruction
Counter-argument considered

The checklist fixes the deployment to the mutable :latest tag of the third-party image that receives the stored Atlassian credentials, and the artifact's own audit treats the unpinned tag as risky, so the undeclared mutable-code surface stands.

Supply chain

mediumContextual risklow confidence

The plan documents validation and CI checks that execute `npx skills add . --list`, running the unpinned `skills` package fetched from the npm registry at run time, undeclared in the fullstack-guardian skill description.

docs/v0.5.0-plan.md:736-745
Confirmed via `npx skills add . --list`: all 65 skills detected
vector:instruction
Counter-argument considered

The plan directs a CI portability check via `npx skills`, which fetches and executes the unpinned `skills` package from the npm registry at run time — the carve-out covers only pinned official-registry installs — and nothing in the declared description covers supply-chain validation tooling, so the finding stands.

Impersonation

lowContextual risklow confidence

The skill's promotional asset asserts unverifiable third-party endorsements (a 'GitHub Trending #3 Repository Of The Day' badge and an 'awesome' list mention) to lend the repository unearned authority with users.

assets/social-preview.png:1
#3 Repository Of The Day
Counter-argument considered

The asset verifiably displays the GitHub Trending and awesome-list badges; the shown evidence contains nothing corroborating these third-party endorsements, and promotional authority claims are neither a declared capability nor a carve-out, so the low-severity observation stands.

Open questions 39

What the analysis could not settle from the code alone.

Nothing in the shown evidence establishes whether ~/.claude/common-ground/ files are auto-loaded by sessions other than explicit /common-ground invocations; the cross-session reach of this persisted state cannot be settled from this pass.
Persistence
The target is declared as 'fullstack-guardian', a security-focused full-stack web development skill, but every shipped unit in this batch is a Jira/Confluence project-management workflow (planning, execution, retrospectives) and an MCP setup guide; the declared description does not cover ticketing or retrospective commands. Is this bundling intentional?
The units describe a full Jira/Confluence workflow command system, Atlassian MCP setup, and an assumption-tracking command; whether these project-management capabilities fall within the skill's declared full-stack implementation scope is not settled by the units shown.
The target skill 'fullstack-guardian' declares full-stack web application building, but every sampled unit is workflow/planning documentation (v0.5.0 plan, skill-idea drafts for the-fool/tarot, phase docs for discovery/planning/execution/retrospective commands); confirm whether these docs are actually loaded into the fullstack-guardian skill context or belong to a different component of the plugin.
Detector leads DET:9425101531354fda, DET:38a4bc95d5308f16, DET:6636e70a2dfc80e9 cite a '| Flag | Mode | Description |' claim and DET:88ad87c2981ef2b4, DET:97f742b25b84dafa, DET:5d0833e23f02bba1, DET:b9d74c7de58e509e, DET:aeeb6519bac6b5c0, DET:9da0028d0acb7922, DET:81e9b3d18ad420d3, DET:e4ba7c3cf0e3b83f cite a '| Condition | Action |' claim that do not appear in the cited units' text; confirm whether the contradiction detectors matched stale or shifted content.
The owed workflow docs direct the agent into a Jira/Confluence project-management workflow (fetching and updating tickets, publishing planning documents, closing epics) and GitHub issue-hierarchy tooling, which is far broader than the skill's declared full-stack implementation description; do higher-level skill instructions bind these workflow docs to the declared task?
Whether the research/ documents (skill trigger hook setup, GitHub issue tree workflows, superpowers framework analysis) are ever loaded into agent context during normal operation of the fullstack-guardian skill, and whether the ~/.claude/settings.json hook installation is intended to be executed by the agent versus presented as human-only reference, is not established by the shown units.
Eight PY-CLAIM-CONTRADICTION detector leads cite claim text (a '| Flag | Mode | Description |' table and a '| Condition | Action |' table mentioning 'No epics found in sprint folder') that appears in none of the shown units; the cited excerpts are benign example application code (fetch to relative /api/users, supertest request(app), WebSocket usage, http.get to api.example.com) inside teaching snippets. The leads appear generated against a different artifact; confirm detector provenance so the f⟦… 32 more chars …⟧
The batch is attributed to target skills/fullstack-guardian, but the first 21 units are sections of skills/feature-forge (interview-questions.md, pre-discovery-subagents.md, specification-template.md). The feature-forge text itself is benign and within its own declared purpose; confirm whether this cross-skill inclusion is intentional bundle packaging or a misattribution of provenance.
The target's declared description covers only security-focused full-stack web app implementation, yet the bundle ships project-workflow commands that read Jira tickets, fetch user-supplied Confluence URLs, and publish/edit Confluence pages and Jira tickets (all gated behind mandatory user-approval checkpoints); confirm whether Jira/Confluence workflow orchestration is within the declared artifact scope or constitutes undeclared additional capability.
All owed units are Jira/Confluence workflow commands and Atlassian MCP setup documentation, none of which is covered by the fullstack-guardian skill's declared description of building full-stack web applications; confirm whether this plugin-level workflow/MCP surface is declared for this target elsewhere or constitutes capability beyond the declared purpose.
All listed contradictions (C22-C33 backtick/arrow excerpts, C140/C136-C139 placeholder Atlassian URLs, C182-C190 .env.local/.gitignore/.mcp.json mentions) were verified against the cited units and none constitutes a genuine broken safety claim: the excerpts are diagram/template characters, the URLs are user-instance placeholders, and the credential/gitignore/MCP-config steps are the disclosed purpose of the setup document; flagging for the refuter to confirm no hidden write/network capability ex⟦… 39 more chars …⟧
The units in this batch are repository documentation (plugin development workflow, docs-site plan, skill-idea plans, v0.5.0 workflow narrative) rather than fullstack-guardian skill content; confirm in other batches whether the skill directory itself matches the declared description, and whether the plugin-cache symlink workflow (residue R3-R8, adjudicated here as unexplained/contextual_risk) is intended solely for this plugin's own developers.
The target's declared description (security-focused full-stack web development) does not match the content of these units (Jira/Confluence workflow orchestration, common-ground assumption tracking under ~/.claude, GitHub issue hierarchies); confirm whether these docs are declared components of this skill or undeclared additions.
Residue R11 claims file_read ~/.claude/logs at research/SKILL_TRIGGER_LOGS.md line 74, but the cited unit contains only 'mkdir -p ~/.claude/logs' (a write); confirm whether any read of ~/.claude/logs occurs there.
Credential access
Whether the research/ documents (SKILL_TRIGGER_LOGS.md, GITHUB_ISSUE_TREE.md, superpowers.md) are presented to users of the fullstack-guardian skill or exist only as repository-internal research, which determines the reach of the undeclared hook-installation instructions into ~/.claude/settings.json.
Persistence
Whether COMMON-GROUND.md and ground.index.json written under ~/.claude/common-ground/ are consumed by any agent control-plane mechanism (memory, rules, hooks) beyond the plugin's own /common-ground --list/--check/--graph modes
Persistence
The decoded fragment ' SKILL_COUNT ' at docs/ideas/audit-primary-docs.md line 108 appears without context; confirm what channel it was recovered from and whether it is a template variable consumed by scripts/update-docs.py rather than executable content.
Do the research/SKILL_TRIGGER_LOGS.md hook instructions target manual setup by the human user, or could the agent itself be directed to perform the ~/.claude/settings.json modification during a task?
Persistence
[file request commands/references/config-resolution.md] Phase 0 config resolution is loaded by every workflow command; does it read anything beyond .claude/workflow-config.json (environment variables, tokens, global agent config) when resolving ticketing and documentation backends?
Credential access
[file request MODELCLAUDE.md] research/superpowers_research_findings.md claims behavioral patterns (systematic-debugging iron laws, three-fix threshold, red flags) were integrated into MODELCLAUDE.md around lines 67-99; what agent-behavior instructions exist in MODELCLAUDE.md at those lines and were they derived from the superpowers research?
Persistence
[file request scripts/update-docs.py] Do the dynamic file reads (file_path.read_text(), open(version_path)) and writes (file_path.write_text(content)) in this script operate only on the plugin's own documentation files, or do they touch credential locations or write outside the repository?
Persistence
[file request commands/intake/document-codebase.md] What does the intake:document-codebase command body instruct the agent to read, scan, send, or write?
Reconnaissance
[file request QUICKSTART.md] Do the three installation methods pin a version or commit, or fetch unpinned remote code, in particular the `claude plugin install https://...` method?
Supply chain
[file request Makefile] What do the dev-link and dev-unlink targets execute — which paths under ~/.claude/plugins/cache are backed up, symlinked, or restored, and is there anything beyond the documented backup/symlink/restore workflow?
Persistence
[file request skills/atlassian-mcp/references/jira-queries.md] Does the Issue Linking reference contain agent-facing behavioral instructions beyond Jira query documentation?
Agent hijacking
[file request skills/atlassian-mcp/references/jira-queries.md] Does this Jira reference contain only documented Jira query and issue-link syntax, or does it also instruct credential handling, network endpoints, or executable behavior beyond query documentation?
Credential access
[file request assets/social-preview.html] Does assets/social-preview.html reference remote resources (web fonts, CDNs, scripts) that puppeteer would fetch during capture-screenshot.js execution?
Supply chain
[file request assets/social-preview.html] capture-screenshot.js renders this page in a headless browser with waitUntil:'networkidle0'; does social-preview.html reference remote resources (CDN fonts, scripts, images) or contain scripts beyond static local rendering that the browser would fetch or execute during capture?
Code execution
[file request atlassian-mcp/references/jira-queries.md] The create-implementation-plan command directs the agent to consult this reference for Issue Linking; does the file contain agent-facing behavioral instructions beyond Jira query documentation?
Agent hijacking
[file request commands/intake/document-codebase.yaml] What does the run-once intake:document-codebase command (first phase of the manifest chain) instruct the agent to read, scan, send, or write?
Reconnaissance
[file request commands/project/discovery/create.yaml] What instructions does the discovery:create command definition carry, given its phase is marked optional but gates the required planning phase and is not shown in this batch?
Reconnaissance
[file request commands/project/execution/complete-ticket.yaml] What does the execution:complete-ticket command (execution-phase command in the manifest, not shown in this batch) instruct the agent to run or modify?
Code execution
[file request QUICKSTART.md] The audit references three installation methods at these lines including `claude plugin install https://...`: does the install fetch unpinned remote code or pin a version/commit?
Supply chain
[file request Makefile] What commands do the dev-link and dev-unlink targets actually execute — specifically which paths under ~/.claude/plugins/cache they move, symlink, or write, and whether they do anything beyond the documented backup/symlink/restore workflow?
Persistence
[file request atlassian-mcp/references/jira-queries.md] The create-implementation-plan command cites this reference for issue-linking syntax ('see atlassian-mcp/references/jira-queries.md > Issue Linking'); does the file contain only documented Jira query/link syntax, or does it also instruct credential handling, network endpoints, or executable behavior beyond query documentation?
Credential access
[file request commands/references/config-resolution.md] How is `.claude/workflow-config.json` located, validated, and loaded, and does any part of config resolution send data off-host or read beyond the config file?
Credential access
[file request CONTRIBUTING.md] The audit says CONTRIBUTING.md step 4 instructs 'cp -r skills/* ~/.claude/skills/' to test changes; does it still instruct copying skills into the user's agent skills directory and with what safeguards?
Persistence
[file request Makefile] What exact commands do the dev-link and dev-unlink targets run against ~/.claude/plugins/cache, and do they only add/remove a symlink as described?
Persistence

Execution chain 165

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 3

DB_HOST
skills/fullstack-guardian/references/integration-patterns.md:314 · instructed
FEATURE_NEW_DASHBOARD
skills/fullstack-guardian/references/integration-patterns.md:224 · instructed
NODE_ENV
skills/fullstack-guardian/references/integration-patterns.md:319 · instructed

Files read 35

.claude/workflow-config.json
docs/v0.5.0-plan.md:36 · instructed
.claude/workflow-config.json
docs/v0.5.0-plan.md:41 · instructed
.claude/workflow-config.json
docs/v0.5.0-plan.md:163 · instructed
.claude/workflow-config.json
docs/v0.5.0-plan.md:569 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:93 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:96 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:101 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:147 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:151 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:245 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:348 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:357 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:376 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:417 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:457 · instructed
.env.local
docs/ATLASSIAN_MCP_SETUP.md:458 · instructed
.mcp.json
docs/ATLASSIAN_MCP_SETUP.md:160 · instructed
.mcp.json
docs/ATLASSIAN_MCP_SETUP.md:339 · instructed
.mcp.json
docs/ATLASSIAN_MCP_SETUP.md:459 · instructed
/home/<user>/.claude/plugins/cache/<plugin>/<name>/<version>
docs/local_skill_development.md:47 · instructed
/Users/yourname/project/.env.local
docs/ATLASSIAN_MCP_SETUP.md:341 · instructed
~/.claude/common-ground/
docs/COMMON_GROUND.md:432 · instructed
~/.claude/common-ground/
docs/COMMON_GROUND.md:433 · instructed
~/.claude/common-ground/{project-id}/COMMON-GROUND.md
docs/COMMON_GROUND.md:179 · instructed
~/.claude/common-ground/{project}/COMMON-GROUND.md
docs/COMMON_GROUND.md:432 · instructed
~/.claude/common-ground/{project}/ground.index.json
docs/COMMON_GROUND.md:433 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:25 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:65 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:73 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:96 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:99 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:100 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:146 · instructed
~/.claude/plugins/installed_plugins.json
docs/local_skill_development.md:41 · instructed
~/.claude/plugins/marketplaces/
docs/local_skill_development.md:24 · instructed

Files written 45

docs/local_skill_development.md:47 · instructed
.bak
docs/local_skill_development.md:56 · instructed
.bak
docs/local_skill_development.md:99 · instructed
.gitignore
docs/ATLASSIAN_MCP_SETUP.md:151 · instructed
[--target=
docs/WORKFLOW_COMMANDS.md:638 · instructed
[execution:execute-ticket
docs/WORKFLOW_COMMANDS.md:786 · instructed
[execution:execute-ticket
docs/WORKFLOW_COMMANDS.md:793 · instructed
[research]
docs/WORKFLOW_COMMANDS.md:793 · instructed
[source-url...]
docs/WORKFLOW_COMMANDS.md:208 · instructed
]
docs/WORKFLOW_COMMANDS.md:208 · instructed
]
docs/WORKFLOW_COMMANDS.md:638 · instructed
/
docs/ideas/audit-workflow-docs.md:326 · instructed
/
docs/local_skill_development.md:24 · instructed
/
docs/local_skill_development.md:25 · instructed
/
docs/local_skill_development.md:26 · instructed
/
docs/local_skill_development.md:47 · instructed
/
docs/local_skill_development.md:55 · instructed
/
docs/local_skill_development.md:56 · instructed
/
docs/local_skill_development.md:65 · instructed
/
docs/local_skill_development.md:73 · instructed
/
docs/local_skill_development.md:96 · instructed
/
docs/local_skill_development.md:99 · instructed
/
docs/local_skill_development.md:100 · instructed
/
docs/local_skill_development.md:146 · instructed
/.claude/plugins/cache/
docs/local_skill_development.md:47 · instructed
~/.claude/plugins/cache/
docs/local_skill_development.md:56 · instructed
~/.claude/plugins/cache/<plugin>/<name>/<version>
docs/local_skill_development.md:65 · instructed
~/.claude/plugins/cache/<plugin>/<name>/<version>
docs/local_skill_development.md:100 · instructed
~/.claude/plugins/cache/<plugin>/<name>/<version>.bak
docs/local_skill_development.md:56 · instructed
${CACHE}.bak
docs/local_skill_development.md:149 · instructed
$CACHE
docs/local_skill_development.md:150 · instructed
$CACHE
docs/local_skill_development.md:159 · instructed
10
skills/fullstack-guardian/references/architecture-decisions.md:99 · instructed
65
docs/ideas/documentation-site.md:104 · instructed
discovery:approve
docs/WORKFLOW_COMMANDS.md:793 · instructed
discovery:synthesize
docs/WORKFLOW_COMMANDS.md:793 · instructed
epics
docs/v0.5.0-narrative.md:229 · instructed
feature-forge
docs/v0.5.0-narrative.md:239 · instructed
features
docs/v0.5.0-narrative.md:222 · instructed
links
docs/ideas/documentation-site.md:342 · instructed
planning:epic-plan
docs/WORKFLOW_COMMANDS.md:793 · instructed
planning:impl-plan
docs/WORKFLOW_COMMANDS.md:786 · instructed
planning:impl-plan
docs/WORKFLOW_COMMANDS.md:793 · instructed
retrospectives:complete-epic
docs/WORKFLOW_COMMANDS.md:786 · instructed
retrospectives:complete-epic
docs/WORKFLOW_COMMANDS.md:793 · instructed

GitHub repositories 7

block/goose
docs/SUPPORTED_AGENTS.md:14 · url
google-gemini/gemini-cli
docs/SUPPORTED_AGENTS.md:13 · url
letta-ai/letta
docs/SUPPORTED_AGENTS.md:15 · url
openai/codex
docs/SUPPORTED_AGENTS.md:11 · url
opencode-ai/opencode
docs/SUPPORTED_AGENTS.md:18 · url
roocodeinc/roo-code
docs/SUPPORTED_AGENTS.md:16 · url
sooperset/mcp-atlassian
docs/ATLASSIAN_MCP_SETUP.md:468 · url

Host config written 3

.mcp.json
docs/ATLASSIAN_MCP_SETUP.md:160 · instructed
.mcp.json
docs/ATLASSIAN_MCP_SETUP.md:459 · instructed
~/.claude/skills/
docs/ideas/audit-primary-docs.md:151 · instructed

Network calls 15

<dynamic>
skills/fullstack-guardian/references/common-patterns.md:17 · instructed
<dynamic>
skills/fullstack-guardian/references/common-patterns.md:39 · instructed
<dynamic>
skills/fullstack-guardian/references/deliverables-checklist.md:65 · instructed
<dynamic>
skills/fullstack-guardian/references/deliverables-checklist.md:77 · instructed
<dynamic>
skills/fullstack-guardian/references/frontend-patterns.md:44 · instructed
<dynamic>
skills/fullstack-guardian/references/frontend-patterns.md:51 · instructed
api.example.com
skills/fullstack-guardian/references/integration-patterns.md:285 · instructed
confluence.yourcompany.com
docs/ATLASSIAN_MCP_SETUP.md:128 · instructed
jira.yourcompany.com
docs/ATLASSIAN_MCP_SETUP.md:133 · instructed
localhost
skills/fullstack-guardian/references/frontend-patterns.md:65 · instructed
yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:59 · instructed
yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:107 · instructed
yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:112 · instructed
yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:301 · instructed
yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:302 · instructed

Packages 4

docker:ghcr.io/sooperset/mcp-atlassian:latest
docs/ATLASSIAN_MCP_SETUP.md:245 · instructed
docker:ghcr.io/sooperset/mcp-atlassian:latest
docs/ATLASSIAN_MCP_SETUP.md:348 · instructed
npm:skills
docs/v0.5.0-plan.md:739 · instructed
npm:skills
docs/v0.5.0-plan.md:742 · instructed

URLs 53

http://localhost:3000
skills/fullstack-guardian/references/integration-patterns.md:308
https://
docs/ideas/audit-primary-docs.md:106
https://
docs/ideas/audit-primary-docs.md:265
https://admin.example.com
skills/fullstack-guardian/references/api-design-standards.md:216
https://agentskills.io/specification
docs/SUPPORTED_AGENTS.md:3
https://agentskills.io/specification
docs/SUPPORTED_AGENTS.md:25
https://agentskills.io/specification
docs/SUPPORTED_AGENTS.md:47
https://ampcode.com
docs/SUPPORTED_AGENTS.md:17
https://ampcode.com/news/agent-skills
docs/SUPPORTED_AGENTS.md:17
https://api.example.com
skills/fullstack-guardian/references/integration-patterns.md:313
https://api.example.com/users
skills/fullstack-guardian/references/integration-patterns.md:285
https://app.example.com
skills/fullstack-guardian/references/api-design-standards.md:215
https://block.github.io/goose/
docs/SUPPORTED_AGENTS.md:14
https://claude.ai/claude-code
docs/SUPPORTED_AGENTS.md:9
https://code.visualstudio.com/docs/copilot/customization/agent-skills
docs/SUPPORTED_AGENTS.md:10
https://confluence.yourcompany.com
docs/ATLASSIAN_MCP_SETUP.md:128
https://cursor.com
docs/SUPPORTED_AGENTS.md:12
https://cursor.com/docs/context/skills
docs/SUPPORTED_AGENTS.md:12
https://developers.openai.com/codex/skills/
docs/SUPPORTED_AGENTS.md:11
https://docs.letta.com/letta-code/skills/
docs/SUPPORTED_AGENTS.md:15
https://docs.roocode.com/features/skills
docs/SUPPORTED_AGENTS.md:16
https://docs.sylph.ai/features/plugins-and-skills
docs/SUPPORTED_AGENTS.md:19
https://example.com/avatar.jpg
skills/fullstack-guardian/references/deliverables-checklist.md:199
https://geminicli.com/docs/cli/skills/
docs/SUPPORTED_AGENTS.md:13
https://github.com/block/goose
docs/SUPPORTED_AGENTS.md:14
https://github.com/features/copilot
docs/SUPPORTED_AGENTS.md:10
https://github.com/google-gemini/gemini-cli
docs/SUPPORTED_AGENTS.md:13
https://github.com/jeffallan
skills/fullstack-guardian/SKILL.md:108
https://github.com/Jeffallan
skills/fullstack-guardian/SKILL.md:6
https://github.com/letta-ai/letta
docs/SUPPORTED_AGENTS.md:15
https://github.com/openai/codex
docs/SUPPORTED_AGENTS.md:11
https://github.com/opencode-ai/opencode
docs/SUPPORTED_AGENTS.md:18
https://github.com/RooCodeInc/Roo-Code
docs/SUPPORTED_AGENTS.md:16
https://github.com/sooperset/mcp-atlassian
docs/ATLASSIAN_MCP_SETUP.md:468
https://id.atlassian.com/manage-profile/security/api-tokens
docs/ATLASSIAN_MCP_SETUP.md:44
https://id.atlassian.com/manage-profile/security/api-tokens
docs/ATLASSIAN_MCP_SETUP.md:414
https://id.atlassian.com/manage-profile/security/api-tokens
docs/ATLASSIAN_MCP_SETUP.md:456
https://jeffallan.github.io/claude-skills/skills/security/fullstack-guardian/
skills/fullstack-guardian/SKILL.md:110
https://jira.yourcompany.com
docs/ATLASSIAN_MCP_SETUP.md:133
https://link-to-agent
docs/SUPPORTED_AGENTS.md:35
https://link-to-docs
docs/SUPPORTED_AGENTS.md:38
https://opencode.ai/docs/skills
docs/SUPPORTED_AGENTS.md:18
https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/
docs/ATLASSIAN_MCP_SETUP.md:467
https://sylph.ai/
docs/SUPPORTED_AGENTS.md:19
https://synergetic.solutions
skills/fullstack-guardian/SKILL.md:7
https://synergetic.solutions
skills/fullstack-guardian/SKILL.md:108
https://yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:59
https://yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:112
https://yourcompany.atlassian.net
docs/ATLASSIAN_MCP_SETUP.md:301
https://yourcompany.atlassian.net/wiki
docs/ATLASSIAN_MCP_SETUP.md:107
https://yourcompany.atlassian.net/wiki
docs/ATLASSIAN_MCP_SETUP.md:302
ws://localhost:3000
skills/fullstack-guardian/references/frontend-patterns.md:65
ws://localhost:3000/presence
skills/fullstack-guardian/references/frontend-patterns.md:119

Linked repositories 7

GitHub repositories it links to or installs from, and whether their names can be taken over.

block/goose
url · not tracked
google-gemini/gemini-cli
url · no ownership changes
letta-ai/letta
url · not tracked
openai/codex
url · not tracked
opencode-ai/opencode
url · not tracked
roocodeinc/roo-code
url · not tracked
sooperset/mcp-atlassian
url · no ownership changes
Refuted findings 10

Candidates the review stage examined and rejected, kept for transparency.

Persistence

criticalRefutedmedium confidence

The common-ground command instructs the agent to write tracked-assumption files into ~/.claude/common-ground/{project_id}/ (COMMON-GROUND.md and ground.index.json), and later invocations load them back, creating cross-session agent state inside the Claude home directory; the destination is disclosed and user-confirmed, so this is reported as contextual risk.

commands/common-ground.md:118
Save to `~/.claude/common-ground/{project_id}/COMMON-GROUND.md`
Why it was refuted

The write is the shipped /common-ground command's declared core function: the doc mandates 'Write ground file', the command yaml declares the ~/.claude/common-ground/ paths as its outputs, and writes are gated behind interactive user confirmation, so the declared-core-capability carve-out applies.

Persistence

criticalRefutedhigh confidence

The /common-ground --check mode instructs the agent to write to the ground file under ~/.claude/common-ground/ (updating the last_validated timestamp), so a mode presented as quick validation persists outside the project, though to the command's own documented state path.

commands/common-ground.md:201
- **All valid:** Update `last_validated` timestamp, confirm
Why it was refuted

The --check flow confirms with the user via AskUserQuestion and then updates the timestamp inside the command's own declared state file; updating that declared output is the command's designed, disclosed capability, so the declared-core-capability carve-out applies.

Credential access

criticalRefutedlow confidence

Setup and debug instructions pass the local credentials file `.env.local` holding Atlassian API tokens into the third-party `mcp-atlassian` Docker container via `--env-file` — an undeclared credential-handling surface for a skill declaring only full-stack web development; corroboration of misuse is absent (credentials go to the wrapped service), so this stays low-confidence contextual risk.

docs/ATLASSIAN_MCP_SETUP.md:245
docker run --rm --env-file .env.local ghcr.io/sooperset/mcp-atlassian:latest --help
Why it was refuted

The tokens in .env.local are the Atlassian API credentials of the very service the mcp-atlassian container wraps and are handed to that wrapped service, so the env-API-keys-for-the-wrapped-service carve-out applies; creating .env.local is itself a declared mandatory setup step of the guide.

Credential access

criticalRefutedlow confidence

The same checklist has the agent configuration file `.mcp.json` and `.env.local` created and populated with Atlassian API credentials — undeclared residue R1 (unexplained), an agent-configuration credential surface the declared full-stack development description never declares; the contradiction against D71 (C197) is spurious because D71 is a Confluence-error-handling table for a retrospective command.

docs/ATLASSIAN_MCP_SETUP.md:459
- [ ] `.mcp.json` created with Atlassian configuration
Why it was refuted

The checklist items restate the documented setup in which .env.local holds only the wrapped service's own Atlassian API tokens, so the credential handling falls under the env-API-keys-for-the-wrapped-service carve-out and the file creation is declared in the guide itself; no misuse surface beyond that is shown.

Persistence

criticalRefutedmedium confidence

The common-ground documentation directs the agent to persist project assumption state to files under ~/.claude/common-ground/, agent-home storage that conditions behavior in future sessions (ESTABLISHED items are treated as premises without re-validation), though the design documents user validation of the content.

docs/COMMON_GROUND.md:179
~/.claude/common-ground/{project-id}/COMMON-GROUND.md
Why it was refuted

Every element of the claim is openly declared in the artifact's own documentation: the same document states assumptions are stored at that path, that ESTABLISHED items are treated as premises, and that they reach that state only through user selection, so the undeclared gate fails; this is the documented, user-validated design of /common-ground (D289, D233), not concealed or undeclared persistence.

Persistence

criticalRefutedmedium confidence

The common-ground phase documentation directs the agent to persist an assumptions ground file and a machine-readable index under the agent's home config directory ~/.claude/common-ground/{project-id}/, creating cross-session agent memory/state outside the project workspace; this is transparent and declared, so it is a low-risk contextual capability rather than an established abuse.

docs/workflow/common-ground.md:23
`~/.claude/common-ground/{project-id}/COMMON-GROUND.md`
Why it was refuted

The finding itself concedes the mechanism is transparent and declared: the same file's overview states assumptions are persisted to a ground file and its Outputs table declares the exact agent-home paths (D289, D233), so the undeclared gate fails; this is the documented, user-reviewed design of the /common-ground command, not an undeclared persistence channel.

Persistence

criticalRefutedmedium confidence

The COMMON-GROUND.md template embeds behavioral directive text that is persisted to ~/.claude/common-ground/{project_id}/COMMON-GROUND.md outside the project and instructs the agent to treat the file's stored assumptions as premises when read back by /common-ground read operations.

references/common-ground/file-management.md:102-104
High confidence assumptions. Treat as premises.
Why it was refuted

The 'directive text' is openly printed in the shipped reference documentation as the declared template for the ground file, and both the persistence location and the read-back flow are declared claims (D289, D351, D286 tier semantics), so nothing is embedded, concealed, or undeclared; the undeclared gate fails and the finding describes the documented design rather than a violation.

Persistence

highRefutedlow confidence

The documentation audit quotes a contribution-testing instruction that copies the repository's skills into the user-level agent skills directory ~/.claude/skills/, a host-config write outside the workspace whose safety depends on the content of the copied skills.

docs/ideas/audit-primary-docs.md:151
cp -r skills/* ~/.claude/skills/
Why it was refuted

The cited text is an audit critique reporting what CONTRIBUTING.md's step says ('Testing instructions are impractical... may not work or may conflict'), not a directive to the agent, so the chain gate fails; the doc's posture is recommending documentation edits, not executing the copy.

Supply chain

mediumRefutedlow confidence

The artifact's own audit documentation records that QUICKSTART.md offers an 'Install from GitHub' method running `claude plugin install https://...` against a mutable, unpinned remote URL, while QUICKSTART.md itself is not served for verification.

docs/ideas/audit-primary-docs.md:93-130
Install from GitHub (`claude plugin install https://...`)
Why it was refuted

The cited unit is audit commentary describing another document's install options — a declared descriptive claim (D158/D159) — and recommends editing the docs, not running the install, so both the undeclared and chain gates fail; QUICKSTART.md itself is not in evidence and would be vendor-installer territory in a fenced install doc.

Supply chain

mediumRefutedlow confidence

The repository's Atlassian MCP setup guide instructs pulling the MCP server Docker image with the mutable ':latest' tag and provides no version-pinning guidance, so setup executes whatever code the registry currently serves — an unpinned remote-code supply risk not covered by the fullstack-guardian skill's declared purpose.

docs/ideas/audit-workflow-docs.md:100
The guide uses `:latest` for the Docker image.
Why it was refuted

The cited text is a third-person audit note critiquing the setup guide and recommending that a pinning note be added to documentation; it issues no instruction to pull or run the image, so the chain gate fails, and the actual ATLASSIAN_MCP_SETUP.md is not served in evidence.

Coverage gaps 6

Parts of the artifact the static analysis could not fully examine.

external_plugin_source plugin 'fullstack-dev-skills' source is not local
.claude-plugin/marketplace.json
request_unanswered request.1: instruction-surface.9/req-update-docs: no answer
invalid_judge_finding request.8
request_unanswered request.9: request.5/social-preview-html: finding: no valid finding cites the answer's evidence
request_unanswered request.9: request.8/cap-preview-html: finding: no valid finding cites the answer's evidence
invalid_judge_finding request.9
fullstack-guardian (Skill) | Beacon Intel