Security audit

Create Pr. Skip

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for creating GitHub pull requests, but it uses generated shell commands with repository-derived text, which creates a review-worthy command-injection risk.

Review the generated PR title, body, and exact gh command before running this skill, especially on untrusted branches or external contributions. Prefer an updated version that writes the body to a file and passes title/body as data arguments instead of interpolating repository-derived text into shell source.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:65
Finding: Shell Command Injection Through Untrusted Pull Request Metadata
Content: View full analysis
(): " --body "$(cat <<'EOF' ## Summary <1-3 sentence overview of what this PR does and why> ## Changes ### Added - ### Changed - ### Fixed - ### Removed - ## Motivation ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed ### Manual Testing Steps ## Breaking Changes ## Related Issues - Closes # - Related to # ## Checklist - [ ] Code follows project style guidelines - [ ] Self-review completed - [ ] Tests pass locally - [ ] Linting passes - [ ] Documentation updated (if needed) EOF )" ``` The values used to replace these placeholders are derived from repository-controlled sources collected earlier in the Skill: ```bash git log --oneline main..HEAD git log --format="### %s%n%n%b" main..HEAD git diff --stat main..HEAD git diff main..HEAD ``` ### Technical Analysis The Skill instructs the agent to derive a pull request title and body from commit messages, branch changes, and file diffs, and then place that generated content directly into shell source code. Commit subjects, commit bodies, branch-related context, file contents, and diffs can be controlled by an untrusted repository contributor. The template does not require shell-safe encoding or validation before this content is embe ...[truncated 2885 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description says "create a pull request with standardized description template," which is broad natural language that could overlap with common requests to open or prepare a PR. The file does not provide explicit trigger phrases, exclusions, or context constraints that clarify when this skill should activate versus when a more general code-assistance action should be used.
Content: No source excerpt is available for this finding.