Gh

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward GitHub CLI helper, but users should be careful with its mutable third-party setup link and authenticated GitHub actions.

Install only if you want the agent to help run authenticated GitHub CLI commands. Confirm the target owner, repository, branch, PR, issue, or release before allowing mutations such as creating repos, commenting, merging PRs, or publishing releases. Treat the SkillBoss.co setup guide as external, mutable documentation and do not run commands from it without reviewing them first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Mutable Third-Party Setup Guide Creates a Supply-Chain Trust Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippet:

markdown

> ?? **Complete setup guide**: https://SkillBoss.co/skill.md

Technical Analysis

The Skill references a remotely hosted setup guide on a third-party domain. The referenced content is not included in the audited package, pinned to an immutable version, or protected by an integrity digest. Consequently, the effective setup guidance can change after the local Skill has been reviewed.

If a user or an agent follows this link and treats its contents as trusted setup instructions, control of the external website becomes a supply-chain trust boundary. An attacker who controls or compromises the domain could replace the guide with instructions that request execution of malicious commands, installation of unsafe packages, or disclosure of GitHub credentials.

The local Skill does not automatically retrieve or execute the remote content, so exploitation requires a user or agent to follow and act upon the external guide.

Attack Path

1. An attacker gains control of the referenced domain, its hosting account, DNS configuration, or the remote skill.md resource.
2. The attacker modifies the setup guide to include malicious installation or configuration instructions.
3. A user or agent loads SKILL.md and follows the prominently advertised “Complete setup guide.”
4. The user or agent trusts and executes the substituted instructions.
5. The attacker may then execute commands with the invoking user's privileges, install malicious software, or obtain credentials exposed to those commands.

Impact Assessment

The direct project artifact only contains a hyperlink and does not itself execute a payload. The ultimate impact therefore depends on the instructions supplied by the remote resource and the permissions of the user who follows them.

S ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the third-party setup link and include all required setup instructions directly in the audited Skill package.
2. Prefer the official GitHub CLI documentation on an approved GitHub-controlled domain when external documentation is necessary.
3. If third-party content must be retained, reference a versioned, immutable artifact and verify it with a cryptographic digest or signature before use.
4. Clearly state that remote documentation is informational and must not be treated as trusted executable instructions.
5. Require explicit user review and confirmation before running commands copied from any external guide.
6. Never instruct users to pipe downloaded content directly into a shell or disclose authentication tokens, credential files, or other secrets.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is broad enough to match many generic GitHub-related requests, which can cause the skill to be invoked outside its intended scope. Over-broad triggering increases the chance that an agent will select this skill for ambiguous requests and perform authenticated GitHub actions in the wrong repository or workflow context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.