GitCode Issue Reply

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:12 PM UTC
• Version: 1.2.0

Overview

The skill fits an issue-reply workflow, but it needs review because it automatically sends issue content to DeepWiki, fetches arbitrary issue-linked images, and retains repository data locally.

Review this skill before installing, especially for private or sensitive repositories. Use it only with a token whose permissions are narrowly scoped, disable DeepWiki and cache/persistence where possible, avoid processing untrusted image links automatically, and confirm the exact comment body before any post is sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/prepare_issue_reply.py:521

Finding

Automatic Disclosure of Issue Content to an External DeepWiki Service

Content

View full analysis

dict: self.request_id += 1 payload = { "jsonrpc": "2.0", "id": self.request_id, "method": method, "params": params or {} } data = json.dumps(payload).encode('utf-8') headers = { 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream', 'User-Agent': 'gitcode-issue-reply/1.4.1', } req = urllib.request.Request( self.base_url, data=data, headers=headers, method='POST' ) ``` ### Technical Analysis DeepWiki integration is enabled by default. When the Skill processes an issue, it sends the repository ...[truncated 2051 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/utils.py:58

Finding

Server-Side Request Forgery and Resource Exhaustion Through Issue-Controlled Image URLs

Content

View full analysis

List[str]: if not text or not isinstance(text, str): return [] urls = [] for match in re.finditer(r'!\[([^\]]*)\]\(([^\s")]+)(?:\s+["\'][^"\']*["\'])?\)', text): url = match.group(2).strip() if url and url not in urls: urls.append(url) html_img_pattern = re.compile(r']+src=["\']([^"\']+)["\']', re.I) for match in html_img_pattern.finditer(text): url = match.group(1).strip() if url and url not in urls: urls.append(url) return urls[:10] ``` ```python def download_image(url: str, temp_dir: Path, max_retries: int = 3, index: int = 0) -> Optional[Path]: import sys from urllib.parse import urlparse import os url = url.strip() url = ''.join(char for char in url if ord(char) >= 32 or char in '\t\n\r') parsed = urlparse(url) filename = os.path.basename(parsed.path) or "image.png" filename = re.sub(r'[<>:"/\\|?*]', '_', filename) if not filename or filename == '.': filename = "image.png" filename = f"{index}_{filename}" local_path = temp_dir / filename for attempt in range(1, max_retries + 1): try: req = urllib.request.Request( url, headers={ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0' } ) with urllib.request.urlopen(req, timeout=30) as response: with open(local_path, 'wb') as f: f.write(response.read()) return local_path except Exception as e: sys.st ...[truncated 3229 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/prepare_issue_reply.py:509

Finding

Remote Issue Content Is Directly Interpolated Into the Agent Prompt

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/prepare_issue_reply.py:637

Finding

Sensitive Repository Content Is Retained in Plaintext Skill Artifacts

Content

View full analysis

Path: base_dir = SKILL_ROOT / "temp_dir" / f"{owner}_{repo}_{issue_number}" base_dir.mkdir(parents=True, exist_ok=True) return base_dir def get_cache_dir() -> Path: base_dir = SKILL_ROOT / "temp_dir" / "cache" base_dir.mkdir(parents=True, exist_ok=True) return base_dir ``` ```python def set_cached_data(cache_key: str, data: Dict) -> bool: try: cache_file = get_cache_dir() / f"{cache_key}.json" with open(cache_file, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False) return True except Exception: return False ``` ```python for issue in all_issues: doc_id = str(issue.get("number", "")) if doc_id in existing_ids: continue title = issue.get("title", "") body = issue.get("body", "") content = f"{title}\n{body}" metadata = { "state": issue.get("state", ""), "labels": issue.get("labels", []), "created_at": issue.get("created_at", ""), } if kb.add_document(doc_id, content, title, metadata): new_count += 1 if new_count > 0: kb_dir.mkdir(parents=True, exist_ok=True) kb.save_to_disk(str(kb_dir)) ``` ```python for i, url in enumerate(image_urls[:5]): local_path = download_image(url, images_dir, index=i) if local_path: image_local_paths.append(str(local_path)) base64_data = image_to_base64(local_path) if base64_data: image_base64_list.append(base64_data) ``` ```python o ...[truncated 3330 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'req' from os.environ.get (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_common.py (reported line 114)May include surrounding context.

python

last_err = None
    for attempt in range(retry_times + 1):
        try:
            with urlopen(req, timeout=30) as f:
                return json.loads(f.read().decode("utf-8"))
        except HTTPError as e:
            last_err = e

Tainted flow: 'req' from os.environ.get (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_common.py (reported line 149)May include surrounding context.

python

last_err = None
    for attempt in range(retry_times + 1):
        try:
            with urlopen(req, timeout=30) as f:
                return json.loads(f.read().decode("utf-8"))
        except HTTPError as e:
            last_err = e

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill requires fetching and processing image URLs from issue content and querying an external knowledge source, but those capabilities are not made prominent in the top-level purpose statement. Because issue content is adversarial by nature, automatic processing of external URLs and third-party context sources increases exposure to malicious payloads, data leakage, and misleading model inputs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is a true security-relevant integrity issue: the script performs a live state-changing API call that posts directly to GitCode, while the skill metadata promises only draft generation for maintainer review. That mismatch can cause an agent or operator to invoke the skill under the false assumption that no external side effect will occur, leading to unauthorized or premature comments being posted from a real account.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool/permission scope even though its instructions require shell execution, network access, environment-variable token use, file read/write, and MCP access. In an agent environment, missing scope declarations weaken least-privilege controls and make it easier for the skill to invoke sensitive capabilities beyond what a reviewer may expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructions and all user-facing prompts are written to require Chinese responses such as 「审阅后请说『发送』或『回复』」 and cancellation phrases, with no opt-in or alternative locale behavior described. This creates a locale/language policy concern because the skill appears to constrain operation to Chinese-only interaction without documenting user choice or justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L01 instructs the model to draft the issue reply in Chinese ('请根据以下信息'). This imposes a specific language on all outputs, and the file does not indicate user opt-in, multilingual fallback, or a region-specific justification for the constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.py (reported line 15)May include surrounding context.

python

from urllib.request import Request, urlopen
from urllib.error import HTTPError, URLError

GITCODE_API_BASE = "https://api.gitcode.com/api/v5"
API_RETRY_TIMES = 2
API_RETRY_INTERVAL = 2

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill attempts to discover GITCODE_TOKEN from multiple ambient sources, including broader process environment and Windows User/Machine environment via PowerShell. In an agent setting, this expands the skill's access beyond user-supplied inputs and can let the skill act with credentials the user did not explicitly intend to expose for a draft-generation workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_common.py (reported line 83)May include surrounding context.

python

if sys.platform == "win32":
        for scope in ("User", "Machine"):
            try:
                out = subprocess.check_output(
                    ["powershell", "-NoProfile", "-Command",
                     "[Environment]::GetEnvironmentVariable('GITCODE_TOKEN','%s')" % scope],
                    creationflags=0x08000000,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs an HTTP POST to the GitCode API and transmits caller-provided data, but the function contains no confirmation prompt, logging, or explicit warning comment describing that outbound transmission. For code files, network calls that transmit user or system data should have some visible disclosure unless the warning is provided elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file adds persistent local storage and reload capability for a BM25 knowledge base, which goes beyond a narrowly scoped skill that is supposed to generate a draft reply for a single user-provided GitCode issue. Persisting issue content and metadata can create unintended retention of repository data across runs, increasing the risk of data leakage, cross-user data mixing, or use of stale/unapproved content in later replies. The skill context makes this more concerning because the manifest describes one-off draft generation rather than maintaining a reusable corpus.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest explicitly says not to use the skill when the user only wants to fetch or query issue data. In contrast, this script's sole purpose is to retrieve and output issue fields from GitCode, making issue fetching a first-class behavior rather than just an internal implementation detail of drafting a reply.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module and CLI explicitly describe posting a comment, contradicting the higher-level skill description that says the skill generates a reply draft for maintainer review. This inconsistency is dangerous because safety boundaries for agents depend on accurate capability descriptions; misleading documentation increases the chance of accidental invocation of a write-capable action in contexts where only non-mutating behavior was expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is scoped as preparing a reply for a single issue, but this code enumerates broad repository issue history and later supports persistent cross-issue indexing. That expands data collection beyond the minimum needed, increasing the chance of retaining unrelated issue content, sensitive discussions, or private repository metadata in local storage without an obvious user need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code extracts attacker-supplied image URLs from issue text/comments, fetches them, and base64-encodes the results for later AI consumption. This can enable SSRF-like outbound requests, local resource abuse, retrieval of oversized or malformed files, and propagation of untrusted binary data into later processing stages not clearly required for drafting a text reply.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Despite the 'read-only' description, the script downloads remote image content and writes it, plus derived artifacts, to local directories. This creates an unintended data-ingestion and persistence channel that can store attacker-controlled content on disk and increases exposure to privacy, storage, and downstream processing risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is entirely in Chinese and states the tool's purpose and handling expectations only in that language. This imposes a language-specific experience without any indication of user opt-in or locale choice, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function performs arbitrary outbound requests to URLs embedded in issue content and saves remote content locally without any user-facing disclosure or consent flow. In a reply-drafting skill, issue content is attacker-controlled, so this can leak network metadata, contact untrusted hosts, and persist untrusted files unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a skill for generating a reply draft for a single GitCode issue with similar-issue references. This helper implements a broader content-ingestion pipeline that extracts external image URLs, downloads them locally, and converts them to base64, which is materially beyond straightforward issue-reply drafting and introduces external resource fetching from issue body content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.