T01 · Skill Instruction Hijacking
Error
- Location
auto.md:86- Finding
Repository-Controlled Instructions Can Hijack Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Oss Pilot
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent GitHub contribution automation skill, but it deserves Review because it combines authenticated GitHub actions and local command execution with under-scoped trust in repository/profile instructions.
Install only if you want an agent to run local repo commands and use your authenticated GitHub identity to push branches, open PRs, and comment. Prefer a container or VM for unfamiliar repos, pin installer versions where possible, review repository/profile instructions as untrusted, and approve shell/GitHub actions one at a time.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
discover.md:228- Finding
Mandatory Dependency Installation Executes Untrusted Repository Lifecycle Scripts
- Content
View full analysis
&& git checkout /main --detach && pnpm install --frozen-lockfile && pnpm tsgo 2>&1 | tail -30 ``` The mandate is repeated later: ```markdown **Important for Source 8**: Run `pnpm install --frozen-lockfile` before any local verification. ``` ### Technical Analysis `pnpm install --frozen-lockfile` prevents lockfile mutation but does not inherently prevent package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. These scripts can execute arbitrary code with the privileges and environment of the Agent process. Both the repository manifest and packages referenced by its lockfile are outside the Skill’s trust boundary. A malicious target repository can define a direct lifecycle script, while a compromised dependency can execute through a transitive installation hook. Mandating installation before verification turns issue discovery into a code-execution event even when no implementation has begun. The project documentation acknowledges malicious build-script risk and recommends containers, but isolation is optional rather than an enforced prerequisite. ### Attack Path 1. An attacker publishes or controls a repository that appears suitable for open-source contribution. 2. The repository includes a malicious package lifecycle script or references a compromised package that contains one. 3. The user invokes discovery against the repository. 4. Source 8 directs the Agent to run `pnpm install --frozen-lockfile`. 5. The package manager executes the lifecycle hook. 6. The hook runs with the Agent process’ ...[truncated 917 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:49- Finding
Installation Instructions Execute a Mutable Remote Package Release
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
auto.md:83- Finding
Unquoted Profile and Input Values Are Interpolated into Shell Commands
- Content
View full analysis
--json defaultBranchRef --jq .defaultBranchRef.name)` `cd && git fetch $DEFAULT_BRANCH && git checkout -b fix/ /$DEFAULT_BRANCH` **Use `upstream_remote` from the profile** -- not hardcoded `upstream` or `origin`. ``` Related unquoted interpolation also appears in `discover.md`, including: ```bash cd && git fetch main ``` ### Technical Analysis The workflow inserts profile and invocation values directly into shell command text without defining validation or shell-quoting requirements. Relevant values include `LOCAL_PATH`, `UPSTREAM_REMOTE`, repository identifiers, and branch components. If one of these values contains shell metacharacters, whitespace, substitutions, or option-like content, it may change command structure rather than being handled as a single argument. Profiles are persistent workspace files and can potentially be modified by an attacker, another process, or an instruction-hijacked Agent. For example, a maliciously altered path containing a command separator could cause an additional command to execute when the documented command is assembled. Remote and branch values can also cause option injection or unsafe ref interpretation. ### Attack Path 1. An attacker causes a repository profile or invocation-derived value to contain shell syntax. 2. The Skill reads the value as `local_path`, `upstream_remote`, repository name, or branch input. 3. The Agent substitutes the value into the documented shell command without validation or quoting. 4. The shell parses attacker-controlled characters as operators, substitutions, redirections, or additional arguments. 5. The injected command e ...[truncated 831 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Read: `discover.md`**
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- ## Repo-Specific Rules <!-- required -- start with build commands, add rules as you learn them --> <!-- Example: - Default branch: main - Package manager: pnpm (monorepo with Turbo)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md - [accepted] <bot> <concern>: <what changed> ## Outcome <!-- added by oss-check retrospective when PR is merged/closed --> - **Result**: merged / closed (reason) - **Reviewed by**: @who -- what they cared about - **What worked**: ...
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md --- ## Repo-Specific Rules - Max open PRs: 10 (hygiene bot auto-closes above this -- no warning, just closes) - Commit script: `scripts/committer` (runs full lint/format/check suite before committing) - Generated files: run `pnpm config:schema:gen` and `pnpm config:docs:gen` after config changes, commit separately - Always run `pnpm format:fix` before committing -- formatter has strict line-breaking rules that differ from editor auto-format
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### Hygiene bot - Auto-closes for: dirty branch (too many files), >10 PRs from same author, stale - No warning -- just closes. Can fire repeatedly. ## Gold Standard Examples
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README recommends installing via
npx clawhub@latest install oss-pilot, which executes code fetched at runtime without pinning to a specific version. If the upstream package is compromised, typosquatted, or a malicious new release is published, users could run attacker-controlled code during installation. In this skill’s context, that risk is more significant because the project already automates shell-heavy workflows and asks users to trust local execution paths.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes very generic phrases such as "find issues," "what should I work on," and "morning check," which can overlap with ordinary user conversation and cause the skill to activate unintentionally. In a skill that can drive git and GitHub automation, accidental invocation increases the chance of unintended repository analysis, command planning, or preparation for code-changing workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is user-invocable and includes several generic trigger phrases such as "auto PR" and "auto fix," which can cause accidental or ambiguous activation in normal conversation. Because this skill performs high-impact actions like modifying local repos, pushing branches, and opening PRs, unintended invocation could launch sensitive workflows without sufficiently explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to activate on common conversational language like "check PRs" or "morning check," which can unintentionally invoke a skill that performs repository inspection and follow-on actions. Because this skill can read local files, query GitHub, and later update/archive context files, accidental invocation can cause unintended data access or state changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs the agent to update and move context files, including archiving files, without prominently warning the user in the skill description that invocation may modify local workspace state. This creates a transparency and consent problem: a user may believe they are requesting a status check, while the skill performs persistent local writes and file moves.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares broad natural-language triggers such as "find issues", "what should I work on", and "next PR", which can match ordinary user intent outside an explicitly security-reviewed OSS workflow. Because this skill performs repository discovery and instructs use of powerful local/GitHub CLI operations, accidental invocation could cause unintended data access, API activity, or autonomous contribution actions in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very generic PR-related terms such as "review PR" and "prepare PR", which can unintentionally activate this skill for ordinary user requests that were not meant to invoke automation. Because this skill performs repo inspection and recommends/coordinates GitHub actions, accidental invocation can cause inappropriate context switching, disclosure of local repo metadata, or unsafe automated guidance in the wrong repository context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 63% confidence
- Finding
The natural-language description presents the system as a GitHub contribution automation workflow using
ghCLI and GitHub PR processes as the default operating mode. While this may be intended, the file does not explicitly frame the constraint as a scoped GitHub-only skill in a way that offers user choice or explains locale/platform limitation beyond the tool references.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md # OSS PR Check-In Skill Check all pending PRs and handle everything that needs attention. Works on any repo with a profile at `./oss-pilot-data/profiles/<repo-name>.md`. ## Invocation
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction "American English spelling (color not colour)" imposes a specific language/locale convention in natural language. Under the policy, forcing a locale without user opt-in or a clearly justified regional requirement is a reportable policy issue.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md 1. **"Is this fix at the right layer?"** -- Trace the call chain 3-5 levels deep. Does the fix address WHERE the problem originates, or WHERE it surfaces? A fix at the wrong layer will be rejected even if it passes tests. 2. **"Does this change affect code paths beyond the stated scope?"** (Blast radius) -- If you're changing a shared function, check all callers. A fix that's correct for one path but breaks another will be caught in review. 3. **"Does this preserve existing semantic contracts?"** -- Data structure invariants, lifecycle guarantees, API response shapes. Breaking a contract that downstream code relies on is worse than the original bug.
Static analysis
No suspicious patterns detected.