Why this verdict
- inconclusive: gap invalid_judge_finding
- inconclusive: unresolved question on EXEC
- inconclusive: unresolved question on unknown class
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 4 candidate findings were refuted on review.
Open questions 3
What the analysis could not settle from the code alone.
The target skill 'release-skills' (declared in .claude/skills/release-skills/SKILL.md frontmatter) is not listed in .claude-plugin/marketplace.json plugins[0].skills, which enumerates only baoyu-* skills; confirm whether release-skills is distributed with the baoyu-skills plugin or shipped separately.
marketplace.json lists 21 baoyu-* skills but does not include release-skills; confirm how the reviewed skill at .claude/skills/release-skills is distributed and loaded within plugin '.'
Supply chain
[file request .releaserc.yml] Does the repository's .releaserc.yml define release.hooks (prepare_artifact/publish_artifact), and if so what commands would they run?
Code execution
Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedmedium confidenceThe skill instructs the agent to execute project-defined prepare_artifact/publish_artifact hooks read from .releaserc.yml, commands whose content the artifact does not ship, so hook commands from a malicious or compromised repository would run arbitrary shell code during any release.
If `release.hooks.publish_artifact` exists, run it once per prepared target
Why it was refuted
Running a project's declared release.hooks.publish_artifact is the skill's documented Project Hook Contract that fulfills its declared core capability (generic-project release support), complete with dry-run placeholders and a user-confirmation gate, and it is explicitly declared (D14) with no undeclared residue or contradiction, so the harm and undeclared gates fail.
Code execution
criticalRefutedlow confidenceThe skill instructs the agent to execute project-defined commands from `.releaserc.yml` (`release.hooks.prepare_artifact`/`publish_artifact`), running arbitrary repository-controlled commands during the release workflow without inspecting them.
If `.releaserc.yml` defines `release.hooks`, keep the release workflow generic and delegate project-specific packaging/publishing to those hooks.
Why it was refuted
Delegating packaging/publishing to .releaserc.yml release hooks is the prominently documented Project Hook Contract — the declared mechanism by which the skill supports generic projects — with mitigation gates (dry-run placeholders, Step-8 confirmation), so it is the declared core capability and fails the harm and undeclared gates rather than constituting smuggled execution.
Code execution
criticalRefutedmedium confidenceThe skill instructs the agent to execute project-defined release.hooks commands (prepare_artifact/publish_artifact) read from .releaserc.yml, a configuration the skill does not ship as consumed content, so the executed commands are unreviewable.
If `prepare_artifact` exists, run it once per target before publish-related checks that need the final releasable target state.
Why it was refuted
Executing prepare_artifact/publish_artifact hooks is the skill's declared exec capability (D6/D14, no undeclared residue or contradiction) documented as a first-class contract with execution rules, dry-run placeholder, and confirmation gates, and the release workflow explicitly inspects and displays the detected configuration, so the harm and undeclared gates fail; the config's absence from the shipped artifact is inherent to per-project config, not concealment.
Agent hijacking
highRefutedlow confidenceThe skill instructs the agent to run the entire release workflow (per-skill commits, version bump, changelog generation, annotated tag) even when the user only said to push with uncommitted changes, expanding a simple push request into release actions before the Step 8 confirmation gate.
If user says
Why it was refuted
Escalating a push request into the release workflow is the skill's own declared behavior: the skill description lists 'push'/'推送' as triggers and the body explicitly instructs that 'just push' still follows all steps, while remote effects stay behind the confirmation gate ('Run only if the user confirmed remote publishing'), so this is declared core capability rather than a concealed hijack.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
bun.lockb
invalid_judge_finding request.0
