Security audit

Open Pull Request

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for opening pull requests, but it arms a default background watcher that can later trigger more repository-changing automation with incomplete bundled details.

Install only if you want an agent to push a branch, open a PR, and by default arm a watcher that may later invoke review-fixing automation. Prefer explicit opt-in for the watcher, confirm how to stop it, and verify whether it can survive the current session before using this in a repository with write-capable credentials.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

Location: SKILL.md:20
Finding: Persistent Externally Triggered Agent Automation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and top-level description claim the skill stops after opening the PR and handing off, but the body explicitly authorizes arming a background watch that can later invoke follow-up behavior automatically. This mismatch can defeat operator expectations and approval boundaries by causing additional actions after the user believes the skill has terminated, especially because those later actions may occur asynchronously and outside the original interactive review moment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation repeatedly says the skill will 'end' and 'stop,' but later instructs it to resume work when the watch fires and proceed into Step 7. That contradiction is dangerous because it obscures the true execution lifecycle and may lead users or host systems to authorize the skill under a shorter, less risky mental model than the one actually implemented.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.