Pans Github Scout

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed GitHub lead-finding tool with some privacy and credential-handling cautions, but no evidence of hidden, destructive, or unrelated behavior.

Install only if you intend to run GitHub lead searches and handle the resulting contact data responsibly. Use a fine-grained, low-privilege GitHub token through GITHUB_TOKEN or a credential manager rather than --token, avoid exporting enriched email/location data unless you need it, and review exported CSV files for privacy and retention requirements.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scout.py:250

Finding

GitHub API Token Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/scout.py, lines 250 and 255
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--token", help="GitHub API Token (or set GITHUB_TOKEN)")

python

scout = GitHubScout(token=args.token)

Technical Analysis

The application permits a GitHub API token to be supplied as a command-line argument. Command-line secrets can be exposed through shell history, process inspection facilities, endpoint monitoring products, diagnostic collections, job definitions, and command logging.

The token is subsequently placed in an HTTP Authorization header and sent only to the fixed official GitHub API endpoint, https://api.github.com. That authenticated network behavior is necessary for the declared GitHub search functionality and is not evidence of unauthorized exfiltration. The weakness is specifically the unnecessary command-line secret input channel.

Attack Path

1. A user launches the script with a command such as python3 scripts/scout.py --token TOKEN_VALUE --search transformer.
2. The complete command may be retained in shell history or captured by process-monitoring and logging systems.
3. A local user, administrator, monitoring-system operator, or party with access to collected logs retrieves the token.
4. The party reuses the token against GitHub's API.
5. Available actions depend on the scopes and repository access granted to that token.

Impact Assessment

Successful exploitation discloses the GitHub API token. An attacker may exercise all GitHub permissions associated with it, potentially including access to private repository metadata or modification of GitHub resources if the user supplied an excessively privileged token.

This issue does not itself escalate beyond the token's existing permissions. Exploitation generally requires local process visibility, shell-history access, or acces ...[truncated 135 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --token command-line option.
2. Read the token from GITHUB_TOKEN or a protected credential provider.
3. If interactive entry is required, use getpass.getpass() so the token is not echoed.
4. For configuration-file support, require restrictive file permissions and avoid committing the file.
5. Recommend short-lived, fine-grained GitHub tokens with only the permissions required for repository search and public organization enrichment.
6. Ensure exceptions, HTTP diagnostics, telemetry, and logs never include authorization headers or token values.
7. Document token rotation and revocation procedures in case accidental command-line exposure has already occurred.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises executable usage and static analysis detected environment access, file writing, and network capabilities, but the manifest does not declare any tool scope or permission boundaries. This creates an authorization and transparency gap: an agent or reviewer cannot tell what the skill is allowed to access before invocation, increasing the chance of unintended network scraping, local data exposure, or writing files without explicit approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and marketing-oriented, including generic terms like '客户发现', 'github scout', and 'AI startup discovery', which can cause the skill to activate in contexts where the user did not intend a GitHub-scanning workflow. Because this skill performs network-enabled lead discovery and can export results, accidental invocation increases the risk of unintended external queries, noisy automation, and data handling actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module description and CLI help/output text are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly allows locale constraints only when they are optional or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The enrichment step automatically fetches and stores additional organization contact details from the GitHub API, including email and location, without a clear privacy notice or explicit opt-in for sensitive fields. Because the skill is specifically designed for prospecting and customer discovery, this context makes bulk collection of contact data more privacy-sensitive and more likely to be misused for unsolicited outreach or non-compliant data processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CSV export persists collected lead data to disk, including organization contact fields such as email, location, and blog, without any warning, consent prompt, minimization, or access control guidance. In this skill's sales lead generation context, that increases the likelihood of quietly assembling and redistributing personal or contact data in ways that may violate internal policy, privacy expectations, or compliance requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The user-facing description and instructions are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale for a region-specific use case. This can violate language/locale policy when a skill imposes one language without user opt-in.

Content

No source excerpt is available for this finding.