GitHub Idea Finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 0.1.0

Overview

The skill appears purpose-built for GitHub project discovery, but it needs review because it mixes GitHub token use, local state writes, and untrusted README content without enough guardrails.

Install only if you are comfortable with a skill that queries GitHub, reads repository READMEs, and saves a local search-session file. Use a fine-grained read-only GitHub token, prefer an environment variable over a checked-in .env file, add .env to .gitignore yourself, and treat any README text returned by the tool as untrusted evidence rather than instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/github_discovery.py:168

Finding

Untrusted Repository README Content Is Exposed to the Agent Without Prompt-Injection Controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: .gitignore:1

Finding

Documented GitHub Token File Is Not Excluded from Version Control

Content

View full analysis

str | None: configured = os.getenv("GITHUB_TOKEN", "").strip() if configured: return configured return dotenv_github_token((Path.cwd() / ".env", Path(__file__).resolve().parents[1] / ".env")) ``` ### Technical Analysis The recommended setup workflow creates a `.env` file containing `GITHUB_TOKEN`. Although the README warns users not to commit the file and states that it should be ignored, the project-provided `.gitignore` does not actually exclude `.env`. This mismatch leaves the credential file visible to ordinary version-control staging operations. A user following the documented setup can accidentally add and publish the token with the repository. Once present in Git history, merely deleting the file in a later commit does not remove the exposed credential from earlier commits. The template itself does not contain a real credential, and the application sends configured tokens only to the hard-coded `https://api.github.com` endpoint. The vulnerability is the failure to protect the real local file that the documentation tells users to create. ### Attack Path 1. A user copies `.env.example` to `.env` as instructed. 2. The user places a valid GitHub token in `GITHUB_TOKEN`. 3. Because `.gitignore` does not exclude `.env`, Git treat ...[truncated 1100 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env.example (reported line 1)May include surrounding context.

text

# Copy to .env and set a GitHub fine-grained token with read-only public repository access.
GITHUB_TOKEN=

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

md

- Python 3.10 或更高版本
- 可访问 `api.github.com`
- 推荐配置 GitHub Personal Access Token

Token 只用于 GitHub API 认证。脚本会优先读取进程环境变量 `GITHUB_TOKEN`，然后读取当前工作目录或 skill 目录下的 `.env` 文件。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Token 只用于 GitHub API 认证。脚本会优先读取进程环境变量 GITHUB_TOKEN，然后读取当前工作目录或 skill 目录下的 .env 文件。

powershell

Copy-Item .env.example .env

编辑 .env：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/github_discovery.py (reported line 63)May include surrounding context.

python

configured = os.getenv("GITHUB_TOKEN", "").strip()
    if configured:
        return configured
    return dotenv_github_token((Path.cwd() / ".env", Path(__file__).resolve().parents[1] / ".env"))


def request_json(path: str, token: str | None = None) -> Any:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description and operating instructions are written in Chinese, with no indication that users may interact in other languages or that the locale is intentionally restricted for a region-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to use filesystem writes, local script execution, and network-based GitHub retrieval, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can let the skill run with broader ambient capabilities than necessary, increasing the chance of unintended file access, command execution, or network use if invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code accesses a sensitive credential via GITHUB_TOKEN and then transmits it in the Authorization header to the GitHub API. While the module docstring describes GitHub retrieval generally, there is no explicit user-facing warning, confirmation, or comment disclosing that credentials may be loaded from .env/environment and sent over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill creates directories and writes a persistent JSON state file containing search history, discovered repositories, and idea text. Although persistence is part of the module's behavior, there is no explicit user disclosure at the write site or in CLI help that local files will be created or modified.

Content

No source excerpt is available for this finding.