ClawHub
Back to skill

Security audit

GitHubCard

Security checks for vulnerabilities and agentic risk

Overview

The skill’s GitHub card features are clearly described, with safeguards for API keys, card deletion, and repository changes.

Expect cards and designs to be published through GitHubCard and creation to use account quota. Authenticate directly rather than sharing your key in chat, and review README changes before committing. Prefer a reviewed, fixed CLI version over the unpinned npx fallback. This review covers the bundled instructions, not the external CLI or hosted service implementation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

MCP server referenced without pinned version: 'npx -y @ghcardhq/ghcard'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Although this is a CLI rather than an MCP server, 'npx -y @ghcardhq/ghcard' downloads and executes an unpinned package with confirmation suppressed. A compromised publisher or malicious future release could execute code with the agent's filesystem and environment access, potentially exposing repository contents or credentials; the stated minimum version does not constrain what npx retrieves.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx without'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
0.1.0 or later). If it is missing and Node.js 20+ is available, run it
   through npx without installing: replace `ghcard` with `npx -y @ghcardhq/ghcard` in
   every command below. Suggest `npm install -g @ghcardhq/ghcard` to the user if they
   will use it again; do not install global packages without asking.
2. Check auth: `ghcard auth status --json`.
   - Exit code 3 / `NO_API_KEY` or `UNAUTHORIZED`: the user needs a key from
     https://githubcard.com/dashboard. Ask them to run

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- Exit code 3 / `NO_API_KEY` or `UNAUTHORIZED`: the user needs a key from
     https://githubcard.com/dashboard. Ask them to run
     `ghcard auth login` themselves, or to set `GHCARD_API_KEY`.
     Never ask the user to paste the key into the chat, and never echo,
     log, or write a key into a file in the repository.
   - Listing templates/palettes works without a key.