github-desktop-zh

• Outcome: Review
• Latest audit: Aug 15, 2026 · 5:47 PM UTC
• Version: 0.1.0

Overview

This is a disclosed GitHub Desktop translation tool, but it should be reviewed carefully because broad trigger phrases can lead to modifying installed application files without an explicit confirmation step.

Install only if you intentionally want an agent to patch GitHub Desktop's installed application files. Prefer --dry-run first, close GitHub Desktop before deployment, avoid --force and --no-backup unless you understand the recovery tradeoff, and ensure any asar or node binary on PATH is trusted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""解包 asar 到 dest_dir，失败 sys.exit。"""
    try:
        os.makedirs(dest_dir, exist_ok=True)
        result = subprocess.run(
            ["asar", "extract", asar_path, dest_dir],
            capture_output=True, text=True, timeout=120,
        )

• Confidence: 83% confidence
• Finding: The script invokes an external asar binary found via PATH to extract an attacker-influenced archive path. While shell injection is not present, the skill context makes this risky because a trojanized or shadowed asar executable could be executed with the user's privileges during normal use of the tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def pack_asar(src_dir, asar_path):
    """打包 src_dir 为 asar 文件，失败 sys.exit。"""
    try:
        result = subprocess.run(
            ["asar", "pack", src_dir, asar_path],
            capture_output=True, text=True, timeout=300,
        )

• Confidence: 83% confidence
• Finding: This packaging step executes the external asar command from PATH against user-controlled source and destination paths. In the context of a desktop-modification skill that users may run locally with elevated rights, PATH hijacking or a malicious asar binary could lead to arbitrary code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# asar 文件不做 node --check；loose js 文件做语法校验
        if f.endswith(".js") and node_available:
            try:
                result = subprocess.run(
                    ["node", "--check", f], capture_output=True, timeout=30,
                )
                if result.returncode == 0:

• Confidence: 81% confidence
• Finding: The script runs node --check on files it has just produced, using whatever node binary resolves in PATH. That creates a local execution trust boundary: a malicious or hijacked node executable could be run simply by using the verification feature, which is more concerning in a user-facing skill intended for broad local execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to overwrite GitHub Desktop installation files and even provides a '--force' option to operate while the application is running, but it does not prominently warn about corruption, failed launches, updater conflicts, or code integrity issues. In this skill’s context, directly modifying packaged application JavaScript is inherently risky because a bad replacement or partial write can break the installed app and create an unsafe recovery situation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad and map to actions that can modify local application files, including deployment and rollback. Because phrases like '应用汉化', '恢复原版', and '更新汉化词典' overlap with ordinary user requests, the skill may activate unexpectedly and lead to unintended file writes or shell execution.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 94% confidence
• Finding: The single short trigger '回滚' is especially risky because it is a common standalone user intent and can match many unrelated conversations. In this skill, activation could invoke rollback logic against local application files, making accidental execution more dangerous than in a read-only skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.