ClawHub
Back to skill

Security audit

GitHub Actions Cache Hardening Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local GitHub Actions cache-audit helper with no evidence of credential theft, persistence, network access, or destructive behavior.

Reasonable to install as a lightweight local checker, but keep `WORKFLOW_GLOB` scoped to workflow files and do not treat its results as a complete security gate until multiline YAML parsing limitations are fixed or independently reviewed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cache-hardening-audit.sh:95
Finding

Multiline YAML Values Bypass Cache Security Checks

Content
View full analysis
Remediation
View remediation
`, `>-`, and `>+`. 6. If a YAML parser cannot be introduced, implement indentation-aware block scalar handling that tracks the parent field and consumes all subordinate lines. This is less reliable than structured YAML parsing and should be treated as a temporary mitigation. 7. Add regression tests for: - Literal and folded multiline paths. - Sensitive paths including `.ssh`, `.aws`, `.npmrc`, `.pypirc`, and `.git`. - Multiline broad `restore-keys` prefixes. - Quoted and unquoted scalar values. - Multiple cache steps in one job. - Comments, blank lines, chomping indicators, expressions, and YAML sequences. 8. Fail safely or emit a prominent parse warning when workflow syntax cannot be interpreted reliably, rather than silently treating the workflow as safe. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
- `actions/cache` usage on untrusted triggers (`pull_request_target`)
- Cache keys that do not use `hashFiles(...)`
- Overly broad `restore-keys` prefixes
- Sensitive paths accidentally included in cache paths (`.aws`, `.ssh`, `.npmrc`, `.git`)
- Floating cache action refs (`@main`, `@master`)

## Inputs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cache-hardening-audit.sh (reported line 98)May include surrounding context.

sh
- `actions/cache` usage on untrusted triggers (`pull_request_target`)
- Cache keys that do not use `hashFiles(...)`
- Overly broad `restore-keys` prefixes
- Sensitive paths accidentally included in cache paths (`.aws`, `.ssh`, `.npmrc`, `.git`)
- Floating cache action refs (`@main`, `@master`)

## Inputs

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs users to run bash and statically audit workflow files, which implies file-reading capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates unnecessary ambiguity about what the skill is permitted to access and weakens least-privilege controls, making misuse or overbroad execution more likely in an agent environment.

Content

No source excerpt is available for this finding.