ClawHub
Back to skill

Security audit

GitHub Automation

Security checks across malware telemetry and agentic risk

Overview

This GitHub automation skill does expected GitHub tasks, but it weakens HTTPS protections while using your GitHub token, so it needs review before use.

Review before installing. Do not use this with a real GitHub token unless TLS verification is restored. If you proceed, use a fine-grained token limited to the specific repositories and actions needed, and manually confirm any action that writes to GitHub.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill advertises code-driven GitHub automation that uses environment variables and network access, but the manifest does not explicitly declare those capabilities or permissions. This creates a transparency and governance gap: users or platforms may not realize the skill can access sensitive tokens and make outbound API calls, increasing the risk of unintended data exposure or overprivileged execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The described behavior does not fully match the stated purpose, and the mismatch includes a serious security issue: disabling SSL certificate verification for GitHub API requests. That can enable man-in-the-middle interception of the GitHub token and API traffic, while undocumented notification access also expands data collection beyond what users may expect.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
TLS certificate validation and hostname checking are explicitly disabled before sending authenticated GitHub API requests. This makes the tool vulnerable to man-in-the-middle interception, allowing an attacker on the network path to read or modify API traffic, including the GitHub token and returned data.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation language is broad enough to trigger on many ordinary GitHub-related requests without strong constraints, which can cause the skill to run in contexts the user did not specifically intend. Because the skill can perform state-changing actions like creating or closing issues, overly broad triggering raises the chance of unintended operations against repositories.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The authentication guidance tells users to set a GitHub token but provides no warning about secure handling, storage, or least-privilege scoping of that credential. In a skill that performs networked GitHub actions, weak token-handling guidance increases the risk of accidental credential leakage, misuse, or excessive repository access if the token is compromised.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.