ClawHub
Back to skill

Security audit

GitHub App

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for GitHub App authentication, but it installs and uses a third-party credential tool with persistent Git/GitHub CLI auth changes and limited safety guidance.

Review the ghapp upstream project and Homebrew tap before installing, use a least-privilege GitHub App installed only on required repositories, avoid printing tokens in shared or logged environments, and understand exactly what shell hooks, path shims, config files, and token caches will persist on the machine.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unverified External Credential-Management Dependency with Self-Update Capability

Content
View full analysis
/config.yaml` (named profile). ``` ### Technical Analysis The skill directs users to install the `ghapp` executable from the third-party Homebrew tap `eliasempresas/tap/g ...[truncated 2719 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- `ghapp config set`, `ghapp config get [key]`, `ghapp config path` — manage config
- `ghapp profile list` — list configured profiles
- `ghapp profile current` — print the profile in effect for this invocation
- `ghapp update` — self-update to latest release
- `ghapp version` — print version

gh auth modes (passed to `auth configure`)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation explicitly advertises ghapp token to print an installation token and notes that tokens are cached locally, but it does not warn that printing tokens can leak credentials into terminal history, logs, CI output, or downstream tooling. In an agent/automation context, exposing ephemeral GitHub App tokens is still dangerous because they can grant repository or organization access for the token lifetime and may be unintentionally persisted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.