GitHub Issues Auto-Fix

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This skill automates real GitHub repository changes but handles tokens unsafely and lets external issue or review text drive privileged agents.

Review before installing. Use only with a narrowly scoped, revocable GitHub token and trusted repositories, avoid --yes/--cron on untrusted issue trackers, and do not run until token printing, token-bearing git remotes, and global git config changes are removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:348

Finding

Untrusted GitHub Content Is Injected into Privileged Sub-Agent Prompts

Content

View full analysis

Repository: {SOURCE_REPO} Issue: #{number} Title: {title} URL: {url} Labels: {labels} Body: {body} Follow these steps in order. If any step fails, report the failure and stop. ``` Review comments are similarly passed directly to a command-capable agent: ```text {json_array_of_actionable_comments} Each comment has: - id: comment ID (for replying) - user: who left it - body: the comment text - path: file path (for inline comments) - line: line number (for inline comments) - diff_hunk: surrounding diff context (for inline comments) - source: where the comment came from (review, inline, pr_body, greptile, etc.) Follow these steps in order: 1. CHECKOUT — Switch to the PR branch: git fetch {PUSH_REMOTE} {branch_name} git checkout {branch_name} git pull {PUSH_REMOTE} {branch_name} 2. UNDERSTAND — Read ALL review comments carefully. Group them by file. Understand what each reviewer is asking for. 3. IMPLEMENT — For each comment, make the requested change: - Read the file and locate the relevant code - Make the change the ...[truncated 3136 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89

Finding

GitHub Token Is Printed into Retained Execution Output

Content

View full analysis

/dev/null | node -e "const fs=require('fs');const d=JSON.parse(fs.readFileSync(0,'utf8'));console.log(d.skills?.entries?.['gh-issues']?.apiKey||'')") ``` ```sh Verify: echo "Token: ${GH_TOKEN:0:10}..." ``` The associated sub-agent records are deliberately preserved: ```text ### Spawn configuration per sub-agent: - runTimeoutSeconds: 3600 (60 minutes) - cleanup: "keep" (preserve transcripts for review) ``` ### Technical Analysis `echo $GH_TOKEN` writes the entire GitHub bearer token to standard output. The prefix verification command also discloses ten token characters without a functional need. Command output is commonly captured by agent execution logs, orchestration telemetry, terminal history, debugging systems, and retained transcripts. This risk is amplified by `cleanup: "keep"`, which intentionally preserves sub-agent transcripts. Access controls for those records may differ from controls protecting the original secret store. A secret that was initially confined to an environment variable or configuration file therefore becomes duplicated into persistent operational records. Checking whether a secret exists does not require printing any ...[truncated 1199 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Remove `echo $GH_TOKEN` and `echo "Token: ${GH_TOKEN:0:10}..."` entirely. 3. Configure the execution framework to redact `GH_TOKEN`, authorization headers, and token-bearing URLs from command output. 4. Ensure shell tracing is disabled while handling credentials: ```sh set +x ``` 5. Avoid retaining secret-bearing transcripts. Apply short retention periods and strict access controls to necessary diagnostic records. 6. Rotate the affected token if the Skill has already been run and its output may have been retained. 7. Prefer short-lived, repository-scoped tokens with only the API permissions required for the selected operation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:447

Finding

GitHub Token Is Persisted in Git Remote Configuration and Global Credential Settings Are Modified

Content

View full analysis

Remediation

View remediation

" \ push -u "$PUSH_REMOTE" "$BRANCH" ``` The header value must still be generated and handled without logging. 4. Preserve credential helpers. If an override is essential, use a command-scoped setting rather than `--global`: ```sh git -c credential.helper= push ... ``` 5. Keep the stored remote URL credential-free: ```sh https://github.com/owner/repository.git ``` 6. If a remote must be changed temporarily, record its original value and restore it in a guaranteed cleanup handler: ```sh original_url="$(git remote get-url "$PUSH_REMOTE")" trap 'git remote set-url "$PUSH_REMOTE" "$original_url"' EXIT ``` 7. Audit existing working copies for token-bearing remote URLs, remove those credentials, and rotate any token that may have been persisted. 8. Run the Skill under a dedicated account with repository-local configuration and narrowly scoped, short-lived credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The sub-agent prompt explicitly instructs reading a stored GitHub token from /data/.clawdbot/openclaw.json or other config files and then revealing part of it in output. This combines secret harvesting from local storage with disclosure into agent-visible transcripts, making credential compromise highly plausible and severe, especially since the token grants repository access and can be reused outside the session.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The review-handler sub-agent has the same secret-harvesting and partial-disclosure behavior as the implementation sub-agent. In a workflow that automatically reacts to external PR comments, this is especially dangerous because adversarial repository content could influence what gets logged or transmitted during an already privileged operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level documentation states 'No gh CLI dependency' and says the skill uses 'curl + the GitHub REST API exclusively.' However, later phases instruct the agent to run multiple git commands for branch management and to use node to read config files for GH_TOKEN resolution. This is an active contradiction in the skill's own documentation about how it operates.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Advertising a flag that skips confirmation is itself part of an autonomous workflow that can make repository changes based on external issue content. In this skill, that autonomy is security-relevant because it combines with token access, git push capability, and sub-agent execution.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

| --watch | false | Keep polling for new issues and PR reviews after each batch |
| --interval | 5 | Minutes between polls (only with `--watch`) |
| --dry-run | false | Fetch and display only — no sub-agents |
| --yes | false | Skip confirmation and auto-process all filtered issues |
| --reviews-only | false | Skip issue processing (Phases 2-5). Only run Phase 6 — check open PRs for review comments and address them. |
| --cron | false | Cron-safe mode: fetch issues and spawn sub-agents, exit without waiting for results. |
| --model | _(none)_ | Model to use for sub-agents (e.g. `glm-5`, `zai/glm-5`). If not specified, uses the agent's default model. |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

Cron mode forcibly enables --yes and then spawns fix agents without waiting for user review, enabling unattended repository modifications driven by remote issue and review content. This is more dangerous than interactive auto-confirm because it is scheduled, persistent, and designed to operate without live oversight.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

**If `--cron` is set:**

- Force `--yes` (skip confirmation)
- If `--reviews-only` is also set, run token resolution then jump to Phase 6 (cron review mode)
- Otherwise, proceed normally through Phases 2-5 with cron-mode behavior active

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill broadens secret access by reading GH_TOKEN not only from the injected environment but also from local OpenClaw config files and a global bot path. That unnecessarily expands the secret retrieval surface and allows the skill or spawned sub-agents to harvest credentials from persistent storage, which is dangerous in an agent context where prompts and downstream outputs may be adversarial.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 613)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 630)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 637)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 644)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 655)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 665)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 807)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 814)May include surrounding context.

text

curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

Where {query_params} is built from:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The --yes mode allows the skill to automatically process and act on all fetched issues without human confirmation, leading to autonomous code changes, branch pushes, and PR creation. In a system that consumes untrusted issue content and spawns privileged sub-agents, this materially increases the chance of unsafe or attacker-influenced repository modifications.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

If `--yes` is active:

- Display the table for visibility
- Auto-process ALL listed issues without asking for confirmation
- Proceed directly to Phase 4

Otherwise:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

If output is non-empty, warn the user:

   > "Working tree has uncommitted changes. Sub-agents will create branches from HEAD — uncommitted changes will NOT be included. Continue?"
   > Wait for confirmation. If declined, stop.

2. **Record base branch:**

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

4. Verify GH_TOKEN validity:

   text

   curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user
   

   If HTTP status is not 200, stop with:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The sub-agent is instructed to print a visible prefix of GH_TOKEN (Token: ${GH_TOKEN:0:10}...), which is direct secret disclosure. Even partial token leakage materially weakens credential secrecy, can aid correlation across logs/transcripts, and is especially risky because transcripts are preserved with cleanup: "keep".

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.

md

- base = "{BASE_BRANCH}"
- PR is created on {SOURCE_REPO}

curl -s -X POST \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/{SOURCE_REPO}/pulls \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The review-handler prompt repeats the same pattern of exposing the first part of GH_TOKEN in output. Because these review sub-agents also preserve transcripts, this creates durable credential leakage into logs and review artifacts.

Content

No source excerpt is available for this finding.