Security audit

github

Security checks across malware telemetry and agentic risk

Overview

This GitHub helper is coherent and disclosed, though it can use the user's GitHub CLI login to read private issue content and create or auto-merge PRs when requested or configured.

Before installing, review any .claude/github.json or ~/.claude/github.json defaults, especially autoMerge, linkKeyword, targetBranch, and reviewers. Use it only with a GitHub CLI account whose repository access you are comfortable applying to issue reads, attachment downloads, PR creation, and configured auto-merge.

SkillSpector

By NVIDIA

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger language is extremely broad, including generic mentions like "gh", "github issues", and instructions to invoke even when the user does not explicitly request the skill. That can cause unintended activation in adjacent contexts, increasing the chance the agent performs GitHub-affecting workflows when the user only meant to discuss GitHub conceptually or use another tool.

Session Persistence

Medium

Category: Rogue Agent
Content: --- name: github description: Work with GitHub issues and pull requests via the gh CLI — query assigned/milestone issues (incl. cross-repo search and Projects v2 boards), read an issue's description AND download+view its embedded screenshots, publish branches, and create PRs with configured house defaults (reviewers, auto-merge, issue linked via closing keyword, one PR per repo). Reads reviewer/branch/title settings from `.claude/github.json` and offers to create it on first use. Use this skill whenever the user says "pull my issues", "what's assigned to me", "read issue 123", "get the screenshots from the issue", "link the PR to the issue", "enable auto-merge", or mentions "gh", "github issues", "github project board" — even if they don't explicitly say "github skill". For "create a PR" defer to the create-pr skill (this skill is its GitHub backend and supplies the PR mechanics). Do not use for Azure DevOps orgs (use the azure-devops skill) or for local git-only operations. --- # GitHub
Confidence: 81% confidence
Finding: The skill relies on persisted configuration from `.claude/github.json` and offers to create that file for future reuse, which introduces session persistence of operational defaults. In a GitHub mutation-capable skill, stale or attacker-influenced persisted settings could silently affect later PR targets, reviewers, link behavior, or auto-merge behavior across sessions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.