ClawHub
Back to skill

Security audit

GitHub Integration

Security checks across malware telemetry and agentic risk

Overview

This GitHub skill is coherent and not deceptive, but it gives an agent direct token-backed power to merge PRs, edit or delete files, and change issues without clear confirmation safeguards.

Install only if you are comfortable giving the agent GitHub write access. Use a fine-grained, expiring token limited to specific repositories, avoid broad classic repo scope, prefer read-only permissions unless writes are needed, and require manual review before merge, delete, or direct file-update commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad and action-oriented, which increases the chance the skill activates from ordinary conversation and performs real GitHub operations unexpectedly. Because this skill can write to repositories, issues, PRs, and labels, accidental invocation can lead to unintended external actions and changes in GitHub state.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises destructive and write-capable operations such as updating files, deleting files, merging PRs, and closing issues without requiring warning language or explicit confirmation. In an agent context, that omission makes unsafe state-changing actions easier to trigger and raises the risk of accidental or socially engineered repository modifications.

External Transmission

Medium
Category
Data Exfiltration
Content
PR_NUM="42"
METHOD="squash"    # merge | squash | rebase

curl -s -X PUT \
  "${BASE_URL}/repos/${OWNER}/${REPO}/pulls/${PR_NUM}/merge" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
89% confidence
Finding
This call merges a pull request, which is a high-impact state-changing operation that can alter production code or default branches. In the skill context, allowing merge execution through broad natural-language triggers and without a mandatory confirmation step creates a meaningful risk of accidental or manipulated repository changes.

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 2 — PUT with the SHA
NEW_CONTENT=$(echo -n "Updated README content here" | base64 -w0)

curl -s -X PUT \
  "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
90% confidence
Finding
This request updates repository file contents, enabling direct modification of source code or documentation in a remote repository. In an agent skill with broad triggers and PAT-based authentication, this is dangerous because a mistaken or prompt-injected instruction could commit unintended or harmful changes externally.

External Transmission

Medium
Category
Data Exfiltration
Content
SHA=$(curl -s "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" | jq -r '.sha')

curl -s -X DELETE \
  "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
94% confidence
Finding
This endpoint deletes a file from a repository, which is an inherently destructive operation with potentially serious consequences for code integrity and availability. Within this skill, destructive GitHub actions are exposed without a mandatory safety interlock, making accidental or coerced deletion a real risk.

External Transmission

Medium
Category
Data Exfiltration
Content
ENCODED=$(echo -n "${NEW_CONTENT}" | base64 -w0)

curl -s -X PUT "https://api.github.com/repos/myorg/myrepo/contents/README.md" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -d "{
Confidence
86% confidence
Finding
The hard-coded GitHub API destination is not the problem by itself, but at this location it is part of a direct repository content update flow, which is high impact. The danger comes from remote state mutation combined with PAT authentication and lack of explicit safety gates.

External Transmission

Medium
Category
Data Exfiltration
Content
# Update file (needs sha)
SHA=$(curl -s $BASE/repos/OWNER/REPO/contents/PATH -H "$H" | jq -r '.sha')
ENCODED=$(echo "new content" | base64 -w0)
curl -s -X PUT $BASE/repos/OWNER/REPO/contents/PATH -H "$H" -d "{\"message\":\"update\",\"content\":\"$ENCODED\",\"sha\":\"$SHA\"}"

# Search code
curl -s "https://api.github.com/search/code?q=QUERY+repo:OWNER/REPO" -H "$H"
Confidence
87% confidence
Finding
This cheat-sheet example shows direct file updates using a bearer-authenticated API call, enabling remote content modification in a concise form likely to be reused. In an agent context, such simplified mutation examples can facilitate unsafe execution if copied into automation without validation or confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
ENCODED=$(echo -n "${NEW_CONTENT}" | base64 -w0)

curl -s -X PUT "https://api.github.com/repos/myorg/myrepo/contents/README.md" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -d "{
Confidence
86% confidence
Finding
The hard-coded GitHub API destination is not the problem by itself, but at this location it is part of a direct repository content update flow, which is high impact. The danger comes from remote state mutation combined with PAT authentication and lack of explicit safety gates.

Credential Access

High
Category
Privilege Escalation
Content
- Repository metadata
- Labels management

All requests use **Bearer token authentication** with a GitHub Personal Access Token (PAT). The base URL is `https://api.github.com`.

---
Confidence
93% confidence
Finding
The skill requires a GitHub Personal Access Token with write-capable scopes, which grants the skill credentialed access to repositories and related resources. In this context, the credential requirement is security-sensitive because broad natural-language activation plus mutation capabilities can cause the token to be used for unintended external actions across potentially private repositories.

Session Persistence

Medium
Category
Rogue Agent
Content
- **description:** Operate GitHub repositories, issues, pull requests, files, and code search using the GitHub REST API via curl. Requires a GitHub Personal Access Token (PAT).
- **trigger phrases:** []
- **trigger phrases (natural English, ≥10):**
  - "create a GitHub issue"
  - "open an issue on"
  - "comment on the PR"
  - "close the issue"
Confidence
79% confidence
Finding
The skill is designed for ongoing authenticated use across a session and is paired with broad natural-language triggers, which can make persistent access to GitHub available longer than necessary. That increases the window in which accidental activation or prompt-manipulated requests can perform remote actions using stored credentials.

Session Persistence

Medium
Category
Rogue Agent
Content
## 7. Installation Guide

### Step 1 — Create a GitHub PAT

1. Navigate to: https://github.com/settings/tokens
2. Click **Generate new token (classic)** or **Generate new token (fine-grained)**.
Confidence
85% confidence
Finding
The installation flow instructs users to create and store a PAT for repeated use, establishing durable authenticated access for the skill. Persistent storage of a token is common, but in this agent context it raises risk because any unsafe invocation of the skill can leverage that standing access to modify or read GitHub resources.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:64

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:565