GitHub PR Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.1

Overview

This is a coherent GitHub PR helper, but it includes repository-changing review, merge, push, and label workflows without enough scoping or approval guidance.

Install only if you are comfortable letting an agent use your authenticated GitHub CLI for PR work. Before merge, review, push, rebase, force-with-lease, label, or auto-merge actions, require explicit confirmation and verify the repository, branch ownership, CI status, review state, and branch protection expectations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk implements only changelog generation from merged PRs. It fetches repository information, optionally resolves a starting release date, lists merged PRs, groups them by labels/title prefixes, and prints a formatted changelog. It does not create PRs, submit or inspect reviews, merge PRs, manage draft state, resolve conflicts, or perform CI/check-status operations. While changelog generation is one part of the declared description, the description substantially overstates the actual capabilities of this code chunk, making it a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk is narrowly focused on creating a pull request, with some convenience features for auto-generating the PR title/body from commit logs and setting draft/labels. It does not perform review, merge, CI status checking, conflict resolution, or changelog generation from merged PRs as claimed in the declared description. While draft creation is supported, the overall declared purpose materially overstates the implemented functionality in this code chunk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The conflict-resolution guidance includes a force-push workflow after rebase, which can rewrite branch history and discard collaborators' work if misapplied. In a PR-management skill, this is especially sensitive because an agent may execute branch-manipulation steps mechanically without understanding branch ownership, protection rules, or coordination requirements.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

git checkout <pr-branch>
git fetch origin
git merge origin/main                # resolve conflicts
git push

# Alternative: rebase instead
git rebase origin/main               # resolve conflicts

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes shell-based operational capabilities (gh, git, bash, python3) but does not declare any permissions or allowed-tools scope. That omission weakens guardrails by making a repository-impacting automation skill less transparent and easier to invoke with broader-than-necessary tool access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents merge, auto-merge, rebase, and push workflows that can directly change shared repository state, but it gives no warning, confirmation requirement, or safety guidance. In an automation context, omission of cautions around repository-impacting commands increases the chance of unintended merges, history rewrites, or pushes to important branches.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gh-pr-changelog.py (reported line 18)May include surrounding context.

python

def run_gh(args):
    try:
        result = subprocess.run(["gh"] + args, capture_output=True, text=True, check=True, timeout=30)
        return result.stdout.strip()
    except subprocess.CalledProcessError as e:
        print(f"gh error: {e.stderr}", file=sys.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gh-pr-create.py (reported line 20)May include surrounding context.

python

def run(cmd, capture=True, check=True):
    try:
        result = subprocess.run(cmd, capture_output=capture, text=True, check=check, timeout=30)
        return result.stdout.strip() if capture else result
    except subprocess.CalledProcessError as e:
        print(f"❌ Command failed: {' '.join(cmd)}\n{e.stderr}")

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/gh-pr-create.py (reported line 83)May include surrounding context.

python

parser.add_argument("--base", help="Base branch (optional, auto-detected)")
    parser.add_argument("--draft", action="store_true", help="Create as draft PR")
    parser.add_argument("--label", action="append", help="Add label (can repeat)")
    parser.add_argument("--yes", "-y", action="store_true", help="Skip confirmation")
    parser.add_argument("--body", help="PR body (optional, auto-generated from commits)")
    args = parser.parse_args()

Static analysis

No suspicious patterns detected.