Branch Protection Auditor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent branch-protection auditor, but its provided fix command can overwrite existing repository protections without preserving stronger controls or requiring a clear review step.

Install only if you will use it as an audit reference and review all generated commands before running them. Do not run the fix command as written on production repositories; first fetch existing branch-protection settings, preserve current status checks and restrictions, target the actual default branch, and require an explicit before-and-after review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:107

Finding

Branch Protection Remediation Can Overwrite Stronger Existing Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107-115
Vulnerability Type: Unsafe replacement of security configuration
Risk Level: High

Vulnerable Code

bash

# Apply protection to a repo
gh api -X PUT "repos/$REPO/branches/main/protection" \
  -f required_pull_request_reviews='{"required_approving_review_count":2,"dismiss_stale_reviews":true,"require_code_owner_reviews":true}' \
  -f required_status_checks='{"strict":true,"contexts":["ci/test","ci/lint"]}' \
  -f enforce_admins=true \
  -f restrictions=null \
  -F allow_force_pushes=false \
  -F allow_deletions=false

Technical Analysis

The documented remediation uses an authenticated PUT request to replace branch-protection settings with a fixed template. It does not retrieve and merge the repository's existing configuration before making the change.

In particular:

• Existing required status-check contexts are replaced with only ci/test and ci/lint.
• restrictions=null explicitly removes existing user, team, or application push restrictions.
• The target branch is hard-coded as main, although the audit process discovers each repository's actual default branch.
• The command lacks a preview, comparison, or confirmation step.
• Repository-specific requirements are not preserved.

A repository may already require stronger or additional checks, such as security scanning, integration tests, deployment approval, provenance verification, or organization-specific policy checks. Replacing those settings can weaken the repository despite the command being presented as a security fix.

Attack Path

1. A repository has existing branch protection with organization-specific status checks or restricted push actors.
2. The audit report recommends applying the documented remediation.
3. An operator with repository administration privileges executes the generated gh api -X PUT command.
4. GitHub replaces the existin ...[truncated 1214 chars]

Remediation

View remediation

Remediation Suggestions

1. Retrieve the current branch-protection configuration before making any modification.
2. Use the repository's discovered default branch rather than hard-coding main.
3. Merge approved changes into the existing configuration instead of replacing all settings with a static template.
4. Preserve all existing required status-check contexts unless an authorized operator explicitly approves their removal.
5. Preserve existing push restrictions. Do not set restrictions to null unless broadening push access is an intentional, separately confirmed action.
6. Generate a before-and-after configuration diff and require explicit operator confirmation.
7. Validate that the configured status-check names exist in the target repository.
8. Use a correctly typed JSON request body and verify the resulting configuration with a follow-up API request.
9. Add a dry-run mode and process repositories individually so that an error cannot weaken protections across an entire organization.
10. Abort remediation if the existing configuration cannot be retrieved or parsed reliably.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

API and Parsing Failures Are Misreported as Missing Branch Protection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-63
Vulnerability Type: Fail-open audit logic and improper exception handling
Risk Level: Medium

Vulnerable Code

bash

# For each repo, check branch protection
gh api "repos/$REPO/branches/$DEFAULT_BRANCH/protection" 2>/dev/null | python3 -c "
import json, sys
try:
    p = json.load(sys.stdin)
    checks = {
        'required_reviews': p.get('required_pull_request_reviews') is not None,
        'min_reviewers': p.get('required_pull_request_reviews', {}).get('required_approving_review_count', 0),
        'dismiss_stale': p.get('required_pull_request_reviews', {}).get('dismiss_stale_reviews', False),
        'require_code_owner': p.get('required_pull_request_reviews', {}).get('require_code_owner_reviews', False),
        'status_checks': p.get('required_status_checks') is not None,
        'strict_checks': p.get('required_status_checks', {}).get('strict', False),
        'enforce_admins': p.get('enforce_admins', {}).get('enabled', False),
        'force_push': not p.get('allow_force_pushes', {}).get('enabled', True),
        'deletions': not p.get('allow_deletions', {}).get('enabled', True),
        'linear_history': p.get('required_linear_history', {}).get('enabled', False),
        'signed_commits': p.get('required_signatures', {}).get('enabled', False),
    }
    for k, v in checks.items():
        status = '✅' if v else '❌'
        print(f'  {status} {k}: {v}')
except:
    print('  ❌ NO PROTECTION RULES')
"

Technical Analysis

The audit suppresses all standard-error output from gh api and uses a bare Python except clause. Consequently, every failure encountered while reading or processing the response is classified as proof that no protection rules exist.

The same output can be produced for materially different conditions, including:

• An actual API response indicating that protection is absent.

...[truncated 2067 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket 2>/dev/null redirection or capture diagnostics in a controlled audit log.
2. Check the exit status of gh api before attempting to parse its output.
3. Handle HTTP outcomes separately:
   • Treat a confirmed 404 for the branch-protection endpoint as absent protection where appropriate.
   • Treat 401 and 403 as authentication or authorization failures.
   • Treat 429 as rate limiting and retry with bounded backoff.
   • Treat transport and server errors as an unknown audit state.
4. Replace the bare except with narrow exception handlers such as json.JSONDecodeError, KeyError, and TypeError.
5. Report failures as UNKNOWN — AUDIT FAILED, not NO PROTECTION RULES.
6. Preserve the repository name, branch name, HTTP status, and sanitized error message in the report.
7. Do not generate or apply remediation for repositories whose audit state is unknown.
8. Validate $REPO and $DEFAULT_BRANCH before constructing the API endpoint.
9. Return a nonzero process status when any repository could not be audited, allowing automation to detect an incomplete scan.
10. Add tests covering absent protection, permission denial, malformed JSON, rate limiting, invalid branches, and network failures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep