github-helper
Analysis
This GitHub helper is mostly purpose-aligned, but it can overwrite a persistent CLAUDE.md knowledge base and reuse repository README text as future agent context.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
claude_md_path = Path(github_dir) / "CLAUDE.md" ... with open(claude_md_path, "w", encoding="utf-8") as file: file.write(content)
The helper replaces CLAUDE.md in the selected repository root. The documented workflow uses this updater for initialization and after clone, but the artifacts do not show backup, merge, or confirmation before overwriting.
Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
The skill metadata does not declare required tooling, while the SKILL.md workflows invoke python3, git, gh, and GitHub MCP. This is a dependency disclosure gap rather than evidence of hidden behavior.
Update this SKILL.md path if needed.
The skill tells the agent to persistently modify its own instruction/configuration file for path changes. The intent is path configuration, but it should be user-approved because it changes future skill behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Use `gh` CLI first, then fall back to GitHub MCP ... gh issue list --repo <owner/repo> --state all --limit 20
The GitHub CLI and GitHub MCP may use the user's authenticated GitHub identity. This is expected for a GitHub helper, but it can access private repositories, issues, or PRs visible to that account.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
content = file.read() ... for line in lines: if not line.startswith("#"): return line[:200]The scanner extracts text from repository README files for summaries, which the workflow stores in CLAUDE.md for future lookup. README text from cloned repositories can be untrusted and is not marked or sanitized as untrusted data.