Skill

publish-release

skill:pybind/pybind11#publish-release

Publish a pybind11 release after the prepare-release PR merged — release branch, tag, stable, GitHub release, and post-release bump. Follows docs/release.rst.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:37 UTC at 2a33aba

findings

low

highest severity

threat classes

397

files scanned

1,039/1,039

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/publish-release:docs/changelog.md:1751:SUPPLY
suspicious: finding skill:.agents/skills/publish-release:docs/changelog.md:1791:SUPPLY

Security findings 2

Supply chain

lowContextual risklow confidence

The changelog cites pull request #3374 under the look-alike GitHub organization name 'pybinyyd' instead of the official 'pybind' org, an undeclared mistyped look-alike URL in static documentation prose that does not resolve to the real project (likely a typo; no fetch or install behavior points at it).

docs/changelog.md:1751

https://github.com/pybinyyd/pybind11/pull/3374

vector:instruction

Counter-argument considered

The look-alike 'pybinyyd' URL is verifiably present in surface changelog prose and is undeclared as intentional (every neighboring PR link uses the official 'pybind' org), so the anomaly is real and nothing in the evidence shows it wrong; however it is static text with no instruction, fetch, or install chain pointing at it, so it stands only as the claimed low-confidence contextual risk.

Supply chain

lowContextual risklow confidence

The changelog cites pull request #2650 under the look-alike GitHub organization name 'pybinyyd' instead of the official 'pybind' org, an undeclared mistyped look-alike URL in static documentation prose that does not resolve to the real project (likely a typo; no fetch or install behavior points at it).

docs/changelog.md:1791

https://github.com/pybinyyd/pybind11/pull/2650

vector:instruction

Counter-argument considered

The look-alike 'pybinyyd' URL is verifiably present in surface changelog prose and is undeclared as intentional, so the anomaly is real and nothing in the evidence shows it wrong; however it is static text with no instruction, fetch, or install chain pointing at it, so it stands only as the claimed low-confidence contextual risk.

Open questions 6

What the analysis could not settle from the code alone.

Detector leads claim network capability in include/pybind11/cast.h:1849 (en.cppreference.com), include/pybind11/pytypes.h:331 (pybind11.readthedocs.io), and include/pybind11/pybind11.h:2389 (github.com). The github.com/pybind/pybind11/pull/4772 URL flagged in pybind11.h appears verbatim in the changelog as a PR citation (SRC:6161f3c53c72b423), and the 'contradicted' claim ('Local only: validate it, then treat its push as the pending step.') in SRC:21f0960ee1e0883a is unconnected to those headers⟦… 188 more chars …⟧

Data exfiltration

All 38 units in this batch are comment/documentation excerpts from pybind11 C++ library headers (include/pybind11/**), not skill-authored instruction text; none address the agent, and directives like 'DO NOT ADD CODE WITH OTHER EXTERNAL DEPENDENCIES' are contributor guidance, not agent steering. Confirm whether these library headers are actually loaded into agent context by the publish-release skill or are incidental repository content, so the correct surface weighting can be applied.

Residue R1 / contradiction C12 adjudication: the 'en.cppreference.com' network hit in cast.h line 1849 is the URL string inside a static_assert diagnostic message ('C++17 feature __cpp_inline_variables not available: https://en.cppreference.com/w/cpp/language/static#Static_data_members'); it is a documentation hyperlink, never dereferenced by any code in the shown units, so no EXFIL capability exists and it cannot break the local-only claims D5/D7. Confirm no other artifact file performs a reque⟦… 16 more chars …⟧

Residue R2 and contradiction C14: the URL literal 'https://pybind11.readthedocs.io/en/stable/advanced/' at include/pybind11/pytypes.h line 331 (unit SRC:5c6db6611b2f795c) was verified against the cited content and is a documentation reference string printed to stderr inside throw_gilstate_error's debugging-advice message ('Please see https://pybind11.readthedocs.io/en/stable/advanced/misc.html#common-sources-of-global-interpreter-lock-errors for debugging advice'); it is never fetched, performs ⟦… 277 more chars …⟧

Data exfiltration

[file request noxfile.py] What commands do the nox sessions tests_packaging, make_changelog, build, and build_global execute, and do any of them run commands beyond testing, changelog generation, and building distributions?

Code execution

[file request noxfile.py] release.rst instructs the agent to run `nox -s tests_packaging`, `nox -s make_changelog`, `nox -s build`, and `nox -s build_global`; what do these nox sessions actually execute, and do any run commands beyond testing, changelog generation, and building distributions?

Code execution

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The release documentation instructs the agent to run the nox sessions tests_packaging, make_changelog, build, and build_global, whose command definitions live in noxfile.py outside the agent-consumed content, so the executed commands cannot be verified at review time.

docs/release.rst:70

``nox -s tests_packaging``

Why it was refuted

Running the named nox sessions is the skill's openly declared core release workflow: the instructions appear verbatim in the documented procedure and the nox tooling is introduced openly in the same document, so the harm gate fails on the declared-core-capability carve-out and the behavior is declared, not concealed; the unreviewable noxfile.py is a repository dependency, not undeclared behavior of this artifact.