GitHub PR Automation Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:00 AM UTC
• Version: 1.0.0

Overview

This GitHub PR automation skill is purpose-related but unsafe because its scripts run shell commands with unvalidated user input while using an authenticated GitHub CLI session.

Install only if you are comfortable reviewing and fixing the scripts first. In particular, replace shell-string execSync calls with argument-array execution, validate PR numbers and branch/template/label inputs, and use least-privileged GitHub credentials. Treat the advertised auto-merge, approval, batch, and metrics features as unsupported by this artifact.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_pr.js:39

Finding

Shell Command Injection in Pull Request Creation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/monitor_pr.js:20

Finding

Shell Command Injection Through Pull Request Number

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code only covers a narrow subset of the declared functionality: PR creation with optional template usage and simple labeling automation. It does not implement review, approval, merging, monitoring of PR or CI status, batch processing, or metrics collection. The description significantly overstates the implemented behavior, so the declared purpose does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

node scripts/monitor_pr.js --pr 123

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and demonstrates network-capable GitHub operations via the gh CLI and Node scripts, but it does not declare any explicit tool scope, permissions, or allowed-tools boundary. That makes the skill harder to constrain at runtime and increases the chance of unintended repository access or outbound actions beyond what a user expects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance is very broad and could cause the skill to be selected for many common PR-related requests, including ones involving sensitive repository modifications. Over-broad routing increases the likelihood that powerful automation is invoked when a narrower, safer skill or manual review would be more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes auto-merge and approval automation without any warning, gating, or human confirmation language, even though these actions can directly change repository state and ship code. In a GitHub automation context, silent approval or merge workflows can bypass review intent, merge unsafe changes, or amplify mistakes across many PRs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes GitHub pull request workflow automation, which reasonably implies interacting with GitHub APIs or tooling, but this implementation does so by spawning local shell commands through child_process.execSync. That adds local command-execution capability, including dependence on the host shell environment, beyond what is semantically necessary for PR management itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script interpolates the user-controlled prNumber directly into a shell command passed to execSync, which invokes a shell. An attacker can supply shell metacharacters such as ;, &&, or command substitution to execute arbitrary commands on the host running the script, not just query a PR.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/create_pr.js:17

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/monitor_pr.js:12