Issue To Pr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:20 AM UTC
• Version: 1.3.0

Overview

The skill mostly matches its GitHub issue-to-PR purpose, but it can act on your GitHub account and includes an unrelated promotional link in generated pull requests.

Review the final PR body before allowing the skill to create a pull request, and remove the generated promotional footer if you do not want to publish it. Use a trusted or pinned installer path where possible, and run the skill only with a GitHub account and repository permissions you are comfortable using for forks, pushes, and PR creation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:400
• Finding: Mandatory Promotional Content in Generated Pull Requests<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:400-420` **Vulnerability Type**: Output manipulation through mandatory skill instructions **Risk Level**: High ### Vulnerable Code ```markdown ``` ## Summary Fixes #{number}. ### Problem {Brief problem description from issue analysis} ### Solution {Brief solution description from fix implementation} ### Changes - {change 1} - {change 2} ### Testing - [x] Existing tests pass - [x] {Any additional verification performed} --- _{🔧 Generated by [issue-to-pr](https://github.com/4yDX3906/issue-to-pr)} ``` ``` ### Technical Analysis The default pull-request template instructs the agent to append a persistent promotional backlink to externally published content. This attribution is unrelated to resolving the user's GitHub issue and alters the output produced on the user's behalf. The behavior is intentional rather than accidental. `CHANGELOG.md:31-33` describes the addition as a promotional footer: ```markdown ### Added - PR body template now includes a promotional footer linking back to the issue-to-pr skill repository ``` Because the footer is embedded in the prescribed PR body rather than presented as an optional attribution, loading and following the Skill modifies the agent's output to promote a third party. This best matches skill instruction hijacking. ### Attack Path 1. A user activates the Skill to fix a GitHub issue. 2. The agent analyzes the target repository and prepares a pull request. 3. The agent uses the default PR body mandated by `SKILL.md`. 4. The promotional link is incorporated into the PR description. 5. After the user approves PR submission, the agent publishes the branded content to GitHub. The path does not require code execution or privilege escalation; it relies on the agent complying with the Skill's output instructions. ### Impact Assessment The issue does not grant additional operating-system or GitHub privileges. Its scope is the content of pull req ...[truncated 479 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the promotional footer from the default pull-request template. 2. Limit the generated PR body to information directly relevant to the issue, fix, and verification results. 3. If attribution is desired, show it to the user as a separate optional field. 4. Require explicit, informed opt-in before adding any branding or backlink to public content. 5. Display the complete final PR body during the confirmation step so the user can review all externally published text. 6. Add a policy test or review check that rejects unrelated promotional links in generated output. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Unpinned Package Execution in Quick Installation Command<![CDATA[ ## Vulnerability Details **File Location**: `README.md:10-14` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## ⚡ Quick Install ```bash npx skills add 4yDX3906/issue-to-pr ``` ``` ### Technical Analysis The documented command invokes `npx` without pinning the `skills` package to a reviewed version. Depending on the local npm configuration and cache state, `npx` may download and execute the current registry release. The command provides no version constraint, checksum, lockfile, or other integrity control. Consequently, the code executed during installation can change after this repository has been audited, without any corresponding change to the reviewed project. No evidence in the audited files establishes that the current `skills` package is malicious. The confirmed weakness is the unsafe, mutable dependency boundary created by the unpinned command. ### Attack Path 1. An attacker compromises the registry package, its publisher account, or a future release of the unpinned `skills` package. 2. A user follows the quick-install command from the README. 3. `npx` resolves the package through the user's configured npm registry. 4. The retrieved package executes with the privileges of the user running the command. 5. Malicious package code could access or modify resources available to that user before or while installing the Skill. This exploitation path depends on compromise or malicious modification of the external package or its distribution channel; such a compromise was not observed within the audited repository. ### Impact Assessment A compromised package invoked through `npx` could execute arbitrary code with the installing user's local privileges. Depending on that user's permissions and environment, the potential scope could include: - Reading or modifying files accessible to the user. - Accessing credentials exposed to the process or stored in user-readable locati ...[truncated 386 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer dependency to a specifically audited version, for example: ```bash npx --yes skills@<audited-version> add 4yDX3906/issue-to-pr ``` 2. Document the expected npm registry, package publisher, and verified package identity. 3. Publish and verify package integrity hashes or signed provenance where supported. 4. Prefer a lockfile-backed installation method for reproducible dependency resolution. 5. Offer the repository's locally reviewable installer as the primary alternative. 6. Advise users not to execute installation commands with administrator or root privileges. 7. Re-audit the pinned package before updating the documented version. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose describes the runtime behavior of a skill that automates resolving GitHub issues and opening PRs. The provided code chunk does not implement any of that functionality. Its primary purpose is package installation management: local dependency checks, copying SKILL.md into a user skill directory, and uninstall cleanup. While installer scripts can be ancillary to a skill, this chunk by itself materially differs from the declared behavior and includes undeclared local file write/delete actions. Therefore the description does not accurately represent what this supplied code chunk actually does.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 3: Manual Install

```bash
mkdir -p ~/.qoder/skills/issue-to-pr
cp SKILL.md ~/.qoder/skills/issue-to-pr/SKILL.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
mkdir -p ~/.qoder/skills/issue-to-pr
cp SKILL.md ~/.qoder/skills/issue-to-pr/SKILL.md
```

## 🚀 Usage

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.