alon-github-security-audit

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 0.1.9

Overview

This is a disclosed static security-review skill that clones GitHub targets and writes local reports, with hardening issues but no evidence of malicious behavior.

Before installing, pin or verify the `npx skills` installer source if possible, and be aware that audits read the target repository and write a persistent local report that may contain repository names, paths, and findings. The cleanup helper should only be used on clone directories created by this skill until its path validation is tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Unpinned npx Package Creates a Mutable Installation Execution Chain<![CDATA[ ## Vulnerability Details **File Location**: `README.md:10` and `README.zh.md:10` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add alondotsh/alon-skills --skill alon-github-security-audit ``` ### Technical Analysis The documented installation command invokes the third-party `skills` package through `npx` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` can retrieve it from the configured npm registry and execute it with the invoking user's privileges. The effective installer code can therefore change after this Skill has been reviewed. The repository does not provide a lockfile, checksum, package version, or other integrity mechanism for this installation path. This is an insecure supply-chain practice, although there is no evidence in the audited files that the current package is malicious. This finding is distinct from the `curl | sh` strings detected in `SKILL.md`. Those strings are explanatory audit indicators and are not executed by this project. ### Attack Path 1. A user follows the Quick Install instructions. 2. `npx` resolves the unversioned `skills` package using the user's configured npm registry. 3. The registry returns the package version selected at installation time. 4. `npx` executes that package locally. 5. If the package, its account, a dependency, or the selected registry has been compromised, attacker-controlled code executes before or during Skill installation. The attack depends on an external supply-chain compromise or registry redirection; no such compromise was confirmed during this offline static audit. ### Impact Assessment A compromised package would execute with the privileges of the user running `npx`. It could potentially: - read or modify files accessible to that user; - access environment variables and locally available credentials; - make network requests; - ...[truncated 285 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer package to a reviewed exact version, for example: ```bash npx --yes skills@X.Y.Z add alondotsh/alon-skills --skill alon-github-security-audit ``` 2. Document the expected npm registry, package publisher, and verified package identity. 3. Provide package integrity information or a lockfile-backed installation workflow where supported. 4. Avoid mutable tags such as `latest` and broad semantic-version ranges for executable installer tooling. 5. Recommend reviewing the resolved package version before allowing `npx` to download and execute it. 6. Consider offering a non-executing manual installation procedure from a pinned Git commit or signed release. 7. Apply the same corrected command to both `README.md` and `README.zh.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: tools/cleanup.py:23
• Finding: Weak Temporary-Directory Validation Permits Recursive Deletion of Unrelated Paths<![CDATA[ ## Vulnerability Details **File Location**: `tools/cleanup.py:23-33` **Vulnerability Type**: Insufficient path validation before recursive deletion **Risk Level**: Medium ### Vulnerable Code ```python import tempfile temp_dir = tempfile.gettempdir() real_path = os.path.realpath(directory) # 解析真实路径，防止 .. 路径遍历攻击 if 'github_audit_' not in real_path or not real_path.startswith(temp_dir): print(f"❌ 拒绝删除非临时目录: {directory}", file=sys.stderr) print(f" 临时目录应在: {temp_dir}", file=sys.stderr) sys.exit(1) try: print(f"🗑️ 清理临时目录: {directory}") shutil.rmtree(directory) ``` ### Technical Analysis The cleanup helper attempts to constrain deletion to generated audit directories, but its authorization check is based on string operations: - `'github_audit_' in real_path` accepts the marker anywhere in the complete path rather than requiring it at the beginning of the immediate directory name. - `real_path.startswith(temp_dir)` does not establish a filesystem parent-child relationship. For example, if the temporary root is `/tmp`, a path beginning with `/tmp-other` also satisfies the string-prefix test. - The deletion operation uses the original `directory` argument rather than the canonical `real_path` that was validated. Consequently, an existing unrelated path can pass the check if its resolved string contains `github_audit_` and begins with the temporary-directory string. The documented normal workflow supplies a randomly generated direct child of the temporary directory, which reduces accidental exposure, but the helper itself accepts arbitrary command-line input and does not enforce that invariant. ### Attack Path 1. An attacker or erroneous caller identifies an unrelated writable directory whose resolved path contains `github_audit_`. 2. The directory is placed under the temporary root or another path that merely shares its string prefix. 3. The crafted path is passed to: ```bash python3 tools/cleanup.py <crafted-path> ``` ...[truncated 1021 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use canonical path objects and enforce an exact parent-and-basename policy before deletion: ```python from pathlib import Path import tempfile temp_root = Path(tempfile.gettempdir()).resolve() target = Path(directory).resolve(strict=True) if ( target == temp_root or target.parent != temp_root or not target.name.startswith("github_audit_") or not target.is_dir() ): print(f"Refusing to delete non-audit directory: {directory}", file=sys.stderr) sys.exit(1) shutil.rmtree(target) ``` Additional hardening should include: 1. Delete the validated canonical path rather than the original input. 2. Require the target to be a direct child of the canonical temporary root. 3. Validate the basename, not a substring in the full path. 4. Reject the temporary root itself and non-directory targets explicitly. 5. Track clone directories created during the current run and permit cleanup only for a returned, internally recorded path. 6. Consider creating a marker file inside each clone directory and verify it before deletion. 7. Add tests for sibling-prefix paths, nested unrelated paths, `..` components, symlinks, missing paths, and the temporary root itself. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to perform a comprehensive static security audit, but the file mainly provides instructions and shell steps for cloning, cleanup, and report-writing without any concrete embedded auditing logic or enforceable checks. That mismatch is dangerous because users may trust the skill as a security control when it may only orchestrate limited actions, creating false assurance around malicious repositories.

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Self-Modification

High

• Category: Rogue Agent

Content

- look for `npm install`, lockfile deletion, unpinned third-party actions, and sensitive output
2. Documentation and prompt-injection review
   - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates
   - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent
   - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass
3. Hardcoded secret classification
   - distinguish public client keys, private API keys, and webhook secrets

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

on review
   - inspect `.github/workflows/*.yml`, `.gitlab-ci.yml`, `Jenkinsfile`, and `Dockerfile`
   - look for `npm install`, lockfile deletion, unpinned third-party actions, and sensitive output
2. Documentation and prompt-injection review
   - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates
   - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent
   - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass
3. Hardcoded secret classification
   - distinguish public client keys, private API keys, and webhook secrets
   - do not treat every key-looking string as equally malicious without context
4. Environment-variable purpose analysis
   - distinguish feature flags, telemetry controls, tool detection variables, and real credentials
5. Network-request safety
   - check for missing timeouts
   - chec

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Script Fetching

High

• Category: Supply Chain

Content

2. Documentation and prompt-injection review
   - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates
   - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent
   - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass
3. Hardcoded secret classification
   - distinguish public client keys, private API keys, and webhook secrets
   - do not treat every key-looking string as equally malicious without context

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

2. Documentation and prompt-injection review
   - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates
   - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent
   - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass
3. Hardcoded secret classification
   - distinguish public client keys, private API keys, and webhook secrets
   - do not treat every key-looking string as equally malicious without context

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

- flag actions pinned only to branches or mutable tags such as `@main`, `@master`, or broad major tags
   - prefer full commit SHA for high-trust release, publish, or secret-bearing workflows
5. registry and dependency-confusion surface
   - inspect `.npmrc`, `.yarnrc.yml`, `pip.conf`, `pyproject.toml`, package scopes, and CI registry config
   - flag private-looking unscoped package names, mixed public/private registries, missing scope-to-registry mapping, or fallback-to-public behavior
6. execution amplifiers
   - identify lifecycle scripts, native binary downloads, remote installer scripts, `curl | sh`, package publish workflows, and tag-triggered release automation

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The install command uses `npx skills` without pinning an exact package version, so users may execute whatever version is currently resolved from the registry at install time. In a security-audit skill, this is more concerning because users are likely to trust the tool with sensitive repositories and local filesystem access, increasing the damage if the upstream package is compromised or a malicious version is published.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: L026-L027 的示例触发语 `audit this repo` 和 `check repo security` 缺少更明确的上下文约束，属于较宽泛的自然语言表达。在支持自然语言调用的环境中，这类短语容易与一般性讨论或普通请求重叠，增加非预期触发的风险。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to run shell commands (`python3 tools/clone_repo.py`, `python3 tools/cleanup.py`, `cp ...`) but does not declare any tool scope or allowed-tools boundary. In an agent setting, undeclared shell capability weakens policy transparency and can lead to overbroad execution authority relative to what installers or runtimes expect.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module docstring, function docstring, and user-facing usage text are written only in Chinese, which imposes a specific language on users without any opt-in or explanation of a region-specific requirement. The policy allows locale constraints only when they are optional or clearly justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains user-facing docstrings and console messages entirely in Chinese, including the usage text and operational status output. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which is not present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 执行浅克隆
        result = subprocess.run(
            ['git', 'clone', '--depth', '1', repo_url, clone_dir],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: 该文件主体内容全部为中文，且未在正文中说明用户可在交互中选择其他语言。根据语言/区域政策检查标准，若技能内容限定特定语言而缺少显式选择或适用性说明，可能构成语言策略上的限制。

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document states that the skill writes a structured audit report to a local directory, but the warning is not especially prominent at the point where outputs are described. Even local-only writes can matter in security workflows because they may create persistent artifacts containing repository names, findings, or sensitive paths without clear user expectation.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill defaults to writing audit reports to local directories such as a configured path or `~/Security-Audit/`, but this side effect is not clearly disclosed in the short description. Silent local writes are lower severity than code execution, but they can surprise users, leak repository metadata into persistent storage, or create privacy concerns on shared systems.

Static analysis

No suspicious patterns detected.