Security audit
Security checks across malware telemetry and agentic risk
This is a legitimate GitHub issue-fixing skill, but it needs review because an included helper can push code and open PRs through the user's GitHub login without the approval and draft safeguards the instructions promise.
Install only if you are comfortable giving the skill access to repositories through your local git and authenticated gh account. Keep pushes and PR creation under explicit user control, review the target repo and branch before use, and prefer fixing or disabling scripts/create_pr.py until it validates inputs, uses shell-free subprocess argument lists, requires confirmation, and creates draft PRs by default. Clear local audit logs after use on private code if they may contain sensitive diffs.
def run_cmd(cmd, check=True):
"""Run shell command and return output."""
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if check and result.returncode != 0:
print(f"Command failed: {cmd}", file=sys.stderr)
print(f"Error: {result.stderr}", file=sys.stderr)# Step 5: Execute
work_dir = cwd or self._working_dir
try:
result = subprocess.run(
command,
shell=True,
capture_output=True,# Execute
work_dir = cwd or self._working_dir
try:
result = subprocess.run(
command, shell=True, capture_output=True, text=True,
cwd=work_dir,
timeout=self.guardrails.behavior.get("timeoutMinutes", 15) * 6066/66 vendors flagged this skill as clean.
No suspicious patterns detected.