T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Untrusted Repository README Content Is Processed Without Prompt-Injection Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
GitHub项目调研器
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate GitHub research purpose, but its instructions use unsafe shell-based lookup examples and do not clearly protect against untrusted repository content or sensitive query disclosure.
Install only if you are comfortable with live GitHub lookups. Do not use confidential product names, customer names, private repository names, or sensitive investigation terms unless external GitHub requests are approved. Agents using this skill should encode query parameters safely, avoid raw shell interpolation, and treat README, issue, and release text as untrusted content that must not control tool use or recommendations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
User-Controlled Search Terms May Be Interpolated Into Shell Commands
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description and activation section include generic phrases such as '怎么选', '评估哪个好', '帮我选一个 XX 工具', and '这个项目怎么样', which can occur in many ordinary conversations not necessarily requesting GitHub repository evaluation. The file does not provide exclusion conditions or narrower scope boundaries to distinguish GitHub-project research from general advice requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This command sends user-supplied search keywords to the GitHub API, creating an external data transmission path. While expected for the skill's purpose, it is still security-relevant because sensitive internal names or investigation topics could be disclosed to a third party if the skill is used without clear consent or sanitization.
- Content
bash # 基础搜索，按 stars 排序 curl -s "https://api.github.com/search/repositories?q=关键词&sort=stars&order=desc&per_page=15" # 如果有多个相关关键词，用 + 连接 curl -s "https://api.github.com/search/repositories?q=openclaw+ui&sort=stars&order=desc"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The alternative GitHub CLI search also transmits search terms externally to GitHub. The risk is context-dependent but real in enterprise or incident-response settings where the mere query content may reveal confidential interests or internal code names.
- Content
md curl -s "https://api.github.com/search/repositories?q=关键词&sort=stars&order=desc&per_page=15" # 如果有多个相关关键词，用 + 连接 curl -s "https://api.github.com/search/repositories?q=openclaw+ui&sort=stars&order=desc" # 也可用 GitHub CLI gh search repos "openclaw dashboard" --sort=stars --limit 15
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Fetching repository metadata from GitHub is an external network action that can expose which repositories a user is investigating. This is not inherently malicious, but it can disclose internal evaluation targets or due-diligence activity when used on sensitive repositories.
- Content
bash # 单项目基础信息 curl -s "https://api.github.com/repos/owner/repo" # 最后一次 commit（判断活跃度） curl -s "https://api.github.com/repos/owner/repo/commits?per_page=1"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Requesting commit history from GitHub reveals interest in a specific repository and creates external telemetry about user activity. In sensitive contexts, this can expose internal tool evaluation or M&A/security-review targets.
- Content
md curl -s "https://api.github.com/repos/owner/repo" # 最后一次 commit（判断活跃度） curl -s "https://api.github.com/repos/owner/repo/commits?per_page=1" # 最近 3 个 release curl -s "https://api.github.com/repos/owner/repo/releases?per_page=3"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Release queries transmit the owner/repo identifier to an external service and may leak what software is under review. The command is functionally appropriate, but the absence of consent/notice makes it a real data-exposure issue.
- Content
md curl -s "https://api.github.com/repos/owner/repo/commits?per_page=1" # 最近 3 个 release curl -s "https://api.github.com/repos/owner/repo/releases?per_page=3" # 最近 5 个 open issues（用于判断维护状态） curl -s "https://api.github.com/repos/owner/repo/issues?state=open&sort=created&per_page=5"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Querying open issues sends the repository identifier externally and may reveal investigation focus. This is especially relevant if the user is assessing private, pre-disclosure, or strategically sensitive projects and assumes the tool is purely local.
- Content
curl -s "https://api.github.com/repos/owner/repo/releases?per_page=3"
最近 5 个 open issues（用于判断维护状态）
curl -s "https://api.github.com/repos/owner/repo/issues?state=open&sort=created&per_page=5"
text ### Step 3：README 深度解析
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill fetches and decodes README content from GitHub, which is an external transmission and content-ingestion step. Although it only prints text, README content is untrusted input and could include deceptive instructions or sensitive references; combined with silent outbound access, this raises the risk above a purely informational fetch.
- Content
bash # 获取 README 内容 curl -s "https://api.github.com/repos/owner/repo/readme" | python3 -c " import sys,json,base64 d=json.load(sys.stdin) print(base64.b64decode(d['content']).decode('utf-8'))
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The quick-filter formula transmits user keywords and constraints to GitHub, again creating an external disclosure channel. Because this workflow encourages repeated searches, it can amplify leakage of sensitive product names, customer names, or internal initiative terms.
- Content
快速筛选公式：
bash # 查看 stars > 100 且 最后更新 < 30天 的项目 curl -s "https://api.github.com/search/repositories?q=关键词+stars:>100&sort=updated&order=desc" | \ python3 -c "import sys,json; d=json.load(sys.stdin); [print(f\"{r['full_name']} | {r['stargazers_count']}⭐ | {r['pushed_at'][:10]}\") for r in d['items'][:10]]"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing instructions, triggers, and output templates are specified exclusively in Chinese, and the skill does not indicate that it can adapt to the user's preferred language. This can violate language/locale policy where skills should not force a single language without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs live GitHub API/CLI queries but does not require a user-facing disclosure that prompts and derived search terms may be transmitted to GitHub. In privacy-sensitive environments, this can leak user interests, internal project names, or proprietary evaluation targets to an external service without informed consent.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 15% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # 基础搜索，按 stars 排序 curl -s "https://api.github.com/search/repositories?q=关键词&sort=stars&order=desc&per_page=15" # 如果有多个相关关键词，用 + 连接 curl -s "https://api.github.com/search/repositories?q=openclaw+ui&sort=stars&order=desc"
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 15% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # 基础搜索,按 stars 排序 curl -s "https://api.github.com/search/repositories?q=关键词&sort=stars&order=desc&per_page=15" # 如果有多个相关关键词,用 + 连接 curl -s "https://api.github.com/search/repositories?q=openclaw+ui&sort=stars&order=desc"
Static analysis
No suspicious patterns detected.