Security audit

Git Hub Projects V2

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent, but it expands from GitHub Projects management into broader authenticated GitHub mutations and an unpinned third-party CLI extension install.

Install only if you want an agent to help mutate GitHub Projects and related issues. Require explicit approval before any write command, prefer built-in gh or reviewed GraphQL calls, avoid the third-party extension unless you have reviewed and pinned it, and use the least-privileged GitHub account or token practical.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:102
Finding: Unpinned Third-Party GitHub CLI Extension Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The changelog states the skill can add comments to issues, create issues, and create sub-issues, which extends beyond the declared project-management scope in the metadata. This scope expansion can mislead operators and downstream agents into granting broader repository-side effects than expected, increasing the risk of unintended issue spam, unauthorized content creation, or abuse of authenticated GitHub capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill presents multiple mutating commands such as gh project item-edit and gh project item-add without clearly warning that they will immediately modify remote GitHub project state. In an agent setting, lack of mutation warnings and confirmation guidance can lead to accidental edits, workflow disruption, and integrity issues in shared project boards.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill's manifest says it is for GitHub Projects v2 management via gh project, but the body also instructs issue commenting, issue creation, and sub-issue workflows. That scope expansion increases the set of remote mutations an agent may perform and can cause unintended repository changes under the guise of a project-management skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs installation and use of a third-party GitHub CLI extension (yahsan2/gh-sub-issue) that is outside the stated gh project scope. Installing external extensions introduces a supply-chain risk and executes unreviewed third-party code in the operator environment, which is materially more dangerous than using built-in gh functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback GraphQL mutation for addSubIssue goes beyond the manifest's described gh project field/item management and provides another path to mutate repository state. Because it uses direct GraphQL mutation with node IDs, it can bypass a user's expectation that this skill is limited to project operations and increases the chance of unintended structural changes to issues.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.