Security audit
Security checks for vulnerabilities and agentic risk
The skill publishes to GitHub as advertised, but unsafe file and credential handling could expose private information.
Review before installing. Use a checked staging folder containing only approved files, reject symlinks, and inspect the upload list because .gitignore is not enforced. Use a token limited to the target repository and keep it in memory. Avoid temporary-token recovery examples and replace real-secret detector tests with synthetic fixtures.
scripts/github-publish.pyRepository-controlled symbolic links can publish files outside the selected directory
An attacker can cause disclosure of readable local secrets or confidential files to the selected repository. Disclosure is public when that repository is public.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req.add_header("Content-Type", "application/json")
for attempt in range(3):
try:
with urllib.request.urlopen(req, timeout=45) as r:
body = r.read().decode()
return r.status, (json.loads(body) if body else {})
except urllib.error.HTTPError as e:
The supplied chunk performs an AST-based name check. It contains no credential retrieval, local-folder publishing, GitHub API requests, repository creation, or commit operations. Its demonstrated purpose is materially different from the declared publishing workflow. This assessment is limited to the supplied chunk.
The supplied code performs a Qt namespace/import consistency check. It contains no credential retrieval, local-folder publishing, GitHub API calls, or blob/tree/commit/ref creation. Its apparent purpose is materially different from the declared GitHub publishing workflow.
Publishing local files and verifying their blob SHAs do not require downloading and scanning all remote blobs for secrets or local paths. This is an additional, undeclared repository-auditing capability with a broader read scope than the stated publishing workflow. The snippet does not establish exfiltration or what happens to detected matches, since the match-handling bodies are omitted.
The skill instructs the agent to read known local files containing real secrets to test detection patterns, without restricting those files to the publication set or requiring specific authorization. Although positive-control testing is legitimate, using unrelated live credentials unnecessarily expands sensitive-data access and creates opportunities for accidental disclosure through tooling or diagnostics.
The code accesses historical repository contents by traversing commits and deduplicating their blobs. That scope is materially different from creating a single commit or checking its published blob SHAs. Although the comment describes downloading and scanning every historical blob, the supplied executable code only inventories blobs from the commits returned by one API request; it does not show blob downloads, scanning, pagination, or publication.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ---- 凭据 / 密钥（⛔ 永远不要提交）----
.env
.env.*
!.env.example
*.key
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## ⭐⭐⭐ 账号改过名 → POST 返回 307（2026-09-29 实测，最容易卡住的一环）
**症状**：脚本在第一个 `POST /git/blobs` 就停住，返回
`307 {"message":"Moved Permanently","url":"https://api.github.com/repositories/<id>/git/blobs"}`。
**根因**：GitHub 账号**改过名**（本机：`ebifry` → **`CatsMansion`**，id 仍是 `51730721`）。
- **GET 会自动跟随重定向** —— 所以「查 ref / 查文件树 / 比 blob sha」这些读操作**全都正常**，
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 拿 id 反查真名
curl -s -H "Authorization: Bearer $TOK" \
https://api.github.com/repositories/<id> | python -c "import json,sys;print(json.load(sys.stdin)['full_name'])"
修法：--owner 换成新名字（CatsMansion）。作者邮箱会自动变成
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
git hash-object --no-filters <文件> :: 对比 API 返回的 sha 前 8 位
curl -sL https://api.github.com/repos/<owner>/<repo>/git/trees/main
注意 git hash-object 要加 --no-filters（否则 autocrlf 会让 CRLF 文件算出不同的哈希）。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TOK=$(tr -d '\r\n' < <那个文件>)
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
-H "Authorization: token $TOK" -H "User-Agent: wb" https://api.github.com/user # 期望 200
curl -sI -H "Authorization: token $TOK" -H "User-Agent: wb" https://api.github.com/user \
| grep -i x-oauth-scopes # 期望能看到 repo
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TOK=$(tr -d '\r\n' < <那个文件>)
curl -s -o /dev/null -w "HTTP %{http_code}\n"
-H "Authorization: token $TOK" -H "User-Agent: wb" https://api.github.com/user # 期望 200
curl -sI -H "Authorization: token $TOK" -H "User-Agent: wb" https://api.github.com/user
| grep -i x-oauth-scopes # 期望能看到 repo
⚠️ 用完**别把它留在磁盘上**，也**不要**为了"以后方便"去长期缓存 token。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 2) 下完整快照当基线（不是只下要改的文件）
curl -sL -H "Authorization: token $TOK" -H "User-Agent: wb" \
"https://api.github.com/repos/<owner>/<repo>/tarball/main" -o main.tgz
mkdir -p stage && tar xzf main.tgz -C stage --strip-components=1
# 3) ⭐ 关键一步：逐文件比 git blob sha，看清哪些真变、方向是什么
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST -H "Authorization: bearer $TOK" \
-H "Content-Type: application/json" https://api.github.com/graphql \
-d '{"query":"{ user(login: \"<user>\") { contributionsCollection { contributionCalendar { totalContributions weeks { contributionDays { date contributionCount } } } } } }"}'
The GCM recovery example redirects a usable GitHub token into a predictable temporary file despite the stated no-disk policy. No restrictive permissions or guaranteed cleanup are shown, leaving a repository-capable credential potentially exposed to other processes, unintended publication, or later collection.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TOK=$(printf 'protocol=https\nhost=github.com\n\n' | GIT_TERMINAL_PROMPT=0 git -c credential.interactive=false credential fill 2>/dev/null | sed -n 's/^password=//p')
# 2) 下完整快照当基线（不是只下要改的文件）
curl -sL -H "Authorization: token $TOK" -H "User-Agent: wb" \
"https://api.github.com/repos/<owner>/<repo>/tarball/main" -o main.tgz
mkdir -p stage && tar xzf main.tgz -C stage --strip-components=1
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
tok = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
if tok:
return tok.strip(), None
p = subprocess.run(["git", "credential", "fill"],
input="protocol=https\nhost=github.com\n\n",
capture_output=True, text=True, timeout=25)
if p.returncode != 0:
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 拿 id 反查真名
curl -s -H "Authorization: Bearer $TOK" \
https://api.github.com/repositories/<id> | python -c "import json,sys;print(json.load(sys.stdin)['full_name'])"
No suspicious patterns detected.