Security audit
Security checks for vulnerabilities and agentic risk
This GitHub skill is a coherent integration, but it should be reviewed because it can create GitHub issues, repositories, and pull requests with a user's token without clear built-in confirmation, and pull-request creation is not fully disclosed in the main docs.
Review this skill before installing. Use the narrowest GitHub token possible, prefer public_repo if private repository access is not needed, and only enable it where you are comfortable with the assistant creating issues, repositories, and pull requests under your account. Treat pull-request creation as available even though the main docs do not list it.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- OpenClaw gateway running
- Node.js 18+
- GitHub account with a Personal Access Token (PAT)
## Setup
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- OpenClaw gateway running
- Node.js 18+
- GitHub account with a Personal Access Token (PAT)
## Setup
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- OpenClaw gateway running
- Node.js 18+
- GitHub account with a Personal Access Token (PAT)
## Setup
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- OpenClaw gateway running
- Node.js 18+
- GitHub account with a Personal Access Token (PAT)
## Setup
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- OpenClaw gateway running
- Node.js 18+
- GitHub account with a Personal Access Token (PAT)
## Setup
The top-level description says the skill can manage repositories, but the documented capabilities include create_repo and the finding indicates code may also create pull requests, which are higher-impact write actions than the summary suggests. Understated destructive or state-changing behavior is dangerous because users may invoke the skill without realizing it can modify GitHub resources.
The top-level description says the skill can manage repositories, but the documented capabilities include create_repo and the finding indicates code may also create pull requests, which are higher-impact write actions than the summary suggests. Understated destructive or state-changing behavior is dangerous because users may invoke the skill without realizing it can modify GitHub resources.
This function can create entirely new GitHub repositories using the caller's token, which is a higher-risk remote write operation than creating an issue. In an agent environment, undisclosed repository creation can be abused to exfiltrate code, stage malicious content, create spoofed projects, or incur organizational governance and compliance issues.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- 📋 **List Repos** — View your repositories with filters
- 📊 **Get Repo Details** — Stars, forks, language, last updated
- 🔄 **Check CI Status** — Monitor CI/CD pipelines
- 📝 **Create Issues** — Open issues from conversation
- 📁 **Create Repos** — Create new repositories
- 🔍 **Search Repos** — Find repos by name/query
- 📊 **Recent Activity** — View recent commits
The skill declares access to credentials and clearly requires network interaction with GitHub, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege enforcement and makes it harder for the platform or reviewer to constrain what the skill is allowed to do, increasing the risk of unintended sensitive operations.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
You: Check CI status on my main project Bot: [shows CI/CD status]
You: Create an issue about the bug Bot: [creates the issue]
The declared API surface exposes state-changing capabilities to create repositories and pull requests, but the manifest description only mentions repository listing, CI checks, issue creation, search, and recent activity. This mismatch can mislead users, reviewers, or policy controls about what the skill is actually able to do, increasing the risk of unauthorized code changes or repository creation through an unexpectedly privileged skill.
The manifest says the skill can 'query and manage GitHub repositories' and specifically lists listing repos, checking CI status, creating issues, searching repos, and viewing recent activity. The code also exports createRepo and createPullRequest, which are materially different write operations not disclosed in the description's examples, expanding the skill beyond the stated behavior.
The skill silently reads GitHub credentials from environment variables or configuration and uses them for authenticated API access without any user-facing disclosure or consent boundary. In an agent setting, hidden credential use increases the risk of actions being taken against a user's GitHub account or private data being queried without the user's clear awareness.
This function performs a remote state-changing action by creating a GitHub issue, but nothing in the code enforces a confirmation or warning before the write occurs. In an autonomous or prompt-driven agent context, that can lead to unintended issue creation, spam, or disclosure of sensitive information into a repository.
This function creates pull requests against repositories using authenticated credentials without a built-in confirmation step or user-facing warning. In practice, an agent could open misleading or unauthorized PRs, trigger CI workflows, or leak sensitive text into code review systems if prompted maliciously or incorrectly.
This declaration file exposes state-changing operations such as creating issues, repositories, and pull requests, but the file contains no user-facing warning, confirmation prompt, or explanatory comment about these write actions. For a code file, such repository-modifying operations should include some visible disclosure unless clearly documented elsewhere in scope.
The exported skill description says only 'Query and manage GitHub repositories' and the inline description emphasizes querying, while the action set includes clearly state-changing operations such as create_issue, create_repo, and create_pull_request. In an agent setting, understated write capability can mislead users or higher-level policy components into authorizing a skill they believe is primarily read-oriented, increasing the chance of unintended remote changes.
The skill exposes create_issue, create_repo, and create_pull_request handlers directly with no visible confirmation, dry-run mode, or user-approval gate before making remote GitHub changes. In a conversational agent context, this is dangerous because ambiguous prompts, prompt injection from repository content, or model mistakes can trigger irreversible or high-impact actions such as creating public repositories, opening unwanted PRs, or filing spam issues under the user's account.
No suspicious patterns detected.