ClawHub
Back to skill

Security audit

GitHub Fetch

Security checks for vulnerabilities and agentic risk

Overview

This GitHub download skill is not malicious, but it should be reviewed because it can use third-party mirrors and install downloaded artifacts into system locations.

Install only if you are comfortable with an agent running local download, extract, git, curl, and install commands for GitHub resources. Prefer user-owned output directories, require pinned SHA-256 checksums before extracting or installing binaries, avoid sudo or /usr/local/bin symlinks unless you explicitly asked for them, and do not set GITHUB_PROXIES to mirrors you do not trust.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tainted flow: 'url' from os.environ.get (line 265, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
def probe_speed(url: str, timeout: int = 15) -> tuple[bool, float, int]:
    """测速：请求前 1MB。返回 (可用, 速度B/s, http状态码)。206=支持range(可续传)。"""
    try:
        r = subprocess.run(
            ["curl", "-sL", "-o", "/dev/null", "-r", "0-1048575",
             "-w", "%{http_code} %{speed_download}", url],
            capture_output=True, text=True, timeout=timeout)
Confidence
84% confidence
Finding
The effective URL can be influenced through GITHUB_PROXIES and is later passed to curl without a '--' separator. If a proxy prefix or URL begins with '-' or otherwise abuses curl's argument parsing behavior, the external tool may treat attacker-controlled input as flags rather than a URL, creating option injection and potentially unexpected network access or local file writes.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to run shell commands, write files, and read environment-controlled configuration such as GITHUB_PROXIES, but it does not declare corresponding permissions. This creates a capability/permission mismatch that can cause the skill to be invoked with more effective power than reviewers or policy expect, increasing the chance of unsafe file writes, downloads, extraction, and installation actions.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill is described primarily as a GitHub fetcher, but it also extracts archives, copies their contents into installation directories, and can place executables into privileged PATH locations. In a tool whose normal use is downloading third-party artifacts from GitHub, bundling install behavior materially increases the chance of users executing untrusted code.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
System-level installation is beyond the minimum required behavior for a fetch utility and expands impact from file download to persistence and execution-path modification. In this context, fetching from GitHub mirrors and then installing content makes supply-chain compromise more dangerous because malicious binaries can become first-class system commands.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The invocation guidance is excessively broad and repeatedly says to use this skill whenever the user mentions GitHub downloads, cloning, binaries, releases, or even generic failures. That can cause over-triggering on common requests and route benign GitHub-related tasks into a skill that performs network fetches, proxy selection, extraction, and installation, expanding the attack surface and increasing the chance of unintended side effects.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code can modify installation directories and create symlinks under /usr/local/bin without prominent user-facing warnings at execution time. For a skill expected to fetch content, this hidden side effect raises the risk of unintended system changes and accidental execution of downloaded binaries.

Static analysis

No suspicious patterns detected.