Security audit

GitHub开发工具

Security checks across malware telemetry and agentic risk

Overview

This GitHub skill is purpose-aligned, but it gives broad GitHub command and API authority without clear scoping or user-confirmation safeguards.

Review this skill before installing. It appears intended for GitHub automation rather than covert behavior, but only use it when you want an agent to operate GitHub through gh CLI. Confirm repository targets, branches, API paths, and webhook URLs before allowing commands that create or modify issues, PRs, workflow runs, API resources, or webhooks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims command execution should be limited to a whitelist, but its own documentation advertises broad `gh` capabilities including direct API access and webhook management. In an agent context with `exec` enabled, this mismatch can normalize unsafe execution patterns and lead to unauthorized remote state changes, data access, or exfiltration through user-influenced `gh api` usage.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation language is very broad, covering general coding, debugging, deployment, and development assistance scenarios, which increases the chance the skill is invoked in contexts where GitHub command execution is unnecessary. Overbroad routing is dangerous because this skill has `exec` capability and can perform remote operations, so accidental activation expands the attack surface and the chance of unintended destructive actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation includes concrete commands that create issues, create PRs, trigger runs, call APIs, and create webhooks, but it does not present prominent warnings that these actions modify remote GitHub state. In an agent setting, users may interpret examples as safe defaults, leading to unintended repository changes, automation triggers, or persistent outbound integrations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.