ClawHub
Back to skill

Security audit

github

Security checks for vulnerabilities and agentic risk

Overview

This is a small GitHub CLI helper skill whose risky commands are visible and aligned with GitHub work, but users should approve any repository-changing action.

Install only if you want Codex to help operate GitHub through the gh CLI. Make sure gh is authenticated to the correct GitHub account, and require clear confirmation before commands that merge PRs, create or close issues, post comments, or rerun workflows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents state-changing GitHub operations like `gh pr merge 55 --repo owner/repo --squash` without any warning, confirmation guidance, or instruction to verify target repo/PR before execution. In an agent setting, this increases the chance of unintended repository modifications because the command is presented as a normal read/write workflow alongside safe read-only commands.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documented `gh issue close 42 --repo owner/repo --comment "Fixed in ..."` command performs a remote state change but is shown without cautionary language or approval requirements. In the context of an automation skill, this can lead to accidental closure of issues, disruption of project workflow, or unauthorized modifications if an agent acts on ambiguous instructions.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill includes `gh run rerun <run-id> --repo owner/repo --failed` without noting that rerunning CI triggers remote workflow execution and may consume resources or execute untrusted workflow logic. While less destructive than merges or issue closure, it still initiates an external action and is risky in an agent-operated environment if done without user awareness.

Static analysis

No suspicious patterns detected.