Security audit

do-issue

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an issue-fixing workflow, but it includes high-impact issue-tracker actions and an external feedback-posting step without clear user approval.

Review this skill before installing, especially on private or sensitive repositories. Require explicit confirmation before any issue comment, issue close, PR creation, or external GitHub Discussions post, and treat issue bodies and comments as untrusted input that should be summarized and sanitized before reaching subagents.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: modules/issue-discovery.md:24
Finding: Untrusted Issue Content Is Forwarded into Privileged Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: modules/completion.md:86
Finding: Workflow Directs Unapproved Publication of Observations to an External Repository
Content: View full analysis
Repo-specific learnings stay in the current repo. Tooling > learnings always go to > https://github.com/athola/claude-night-market/discussions > so the framework can improve. ``` ### Technical Analysis The completion workflow instructs the agent to publish tooling observations to a repository controlled by a third party. This action is outside the minimum operations required to implement issues in the user's current repository. The instruction does not require explicit user consent, show the exact content before publication, or define mandatory redaction rules. Although it distinguishes tooling observations from repository-specific learnings, practical tooling reports may still contain private repository identifiers, absolute paths, issue content, prompts, command output, error messages, hook configuration, source excerpts, or operational details. The post would also be made using the user's authenticated forge identity. Consequently, the workflow can produce an external side effect and potential information disclosure without a clear authorization checkpoint. ### Attack Path 1. The ...[truncated 1316 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · modules/parallel-execution.md (reported line 259)May include surrounding context.
md
### Key Difference from Task Tool Task tool subagents are **fire-and-forget** — they can't communicate mid-execution. Agent teams teammates can **send messages to each other** when they discover shared concerns. This prevents merge conflicts and duplicate work that Task tool batches would catch only at the review gate. ### Fallback

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest and top-level description frame the skill as GitHub/GitLab-focused, but the body also claims Bitbucket support and says platform detection is automatic. This mismatch can cause the agent or user to invoke unsupported workflows against the wrong platform, leading to incorrect command selection, failed operations, or actions taken under false assumptions about capability and safety checks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad generic terms like "github," "gitlab," "issues," "automation," and "parallel," which increases the chance the skill is auto-selected in unrelated contexts. Because this skill can orchestrate subagents and perform external issue operations, unintended activation raises the risk of unnecessary repository actions, noisy comments, or closure workflows being proposed or executed in the wrong task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents commands for commenting on and closing issues, and later mentions issue updates, but it does not clearly warn at the description level that it may perform remote state-changing actions on the user's behalf. In an automation skill that uses parallel subagents, inadequate disclosure is especially risky because users may not realize the skill can post public comments or close tracker items, causing unintended workflow changes and audit-impacting side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented workflow expands from implementing issues into publishing framework/tooling feedback to a third-party location, which is outside the stated purpose of the skill. This scope expansion is risky because an issue-resolution skill may carry forward contextual details from the working repository and disclose them during the unrelated publication step.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow instructs the agent to post tooling reflections to an external GitHub repository unrelated to the user’s current project. This creates an unauthorized data egress path that can disclose repository names, workflow details, internal tooling behavior, or sensitive operational context outside the intended trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs posting reflections to an external GitHub Discussions URL without warning about the risk of sharing repository, codebase, or workflow details externally. In an agentic workflow, users may assume all actions stay within the current repo, so this omission materially increases the chance of inadvertent leakage of sensitive or proprietary information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.