ClawHub
Back to skill

Security audit

GitHub Integration

Security checks across malware telemetry and agentic risk

Overview

This GitHub skill is coherent and not deceptive, but it gives an agent direct token-backed power to merge PRs, edit or delete files, and change issues without clear confirmation safeguards.

Install only if you are comfortable giving the agent GitHub write access. Use a fine-grained, expiring token limited to specific repositories, avoid broad classic repo scope, prefer read-only permissions unless writes are needed, and require manual review before merge, delete, or direct file-update commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad and action-oriented, which increases the chance the skill activates from ordinary conversation and performs real GitHub operations unexpectedly. Because this skill can write to repositories, issues, PRs, and labels, accidental invocation can lead to unintended external actions and changes in GitHub state.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises destructive and write-capable operations such as updating files, deleting files, merging PRs, and closing issues without requiring warning language or explicit confirmation. In an agent context, that omission makes unsafe state-changing actions easier to trigger and raises the risk of accidental or socially engineered repository modifications.

External Transmission

Medium
Category
Data Exfiltration
Content
PR_NUM="42"
METHOD="squash"    # merge | squash | rebase

curl -s -X PUT \
  "${BASE_URL}/repos/${OWNER}/${REPO}/pulls/${PR_NUM}/merge" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
89% confidence
Finding
curl -s -X PUT \ "${BASE_URL}/repos/${OWNER}/${REPO}/pulls/${PR_NUM}/merge" \ -H "Authorization: Bearer ${GH_TOKEN}" \ -H "Accept: application/vnd.github+json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 2 — PUT with the SHA
NEW_CONTENT=$(echo -n "Updated README content here" | base64 -w0)

curl -s -X PUT \
  "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
90% confidence
Finding
curl -s -X PUT \ "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \ -H "Authorization: Bearer ${GH_TOKEN}" \ -H "Accept: application/vnd.github+json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
SHA=$(curl -s "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" | jq -r '.sha')

curl -s -X DELETE \
  "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
Confidence
94% confidence
Finding
curl -s -X DELETE \ "${BASE_URL}/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" \ -H "Authorization: Bearer ${GH_TOKEN}" \ -H "Accept: application/vnd.github+json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
ENCODED=$(echo -n "${NEW_CONTENT}" | base64 -w0)

curl -s -X PUT "https://api.github.com/repos/myorg/myrepo/contents/README.md" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -d "{
Confidence
86% confidence
Finding
curl -s -X PUT "https://api.github.com/repos/myorg/myrepo/contents/README.md" \ -H "Authorization: Bearer ${GH_TOKEN}" \ -H "Accept: application/vnd.github+json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# Update file (needs sha)
SHA=$(curl -s $BASE/repos/OWNER/REPO/contents/PATH -H "$H" | jq -r '.sha')
ENCODED=$(echo "new content" | base64 -w0)
curl -s -X PUT $BASE/repos/OWNER/REPO/contents/PATH -H "$H" -d "{\"message\":\"update\",\"content\":\"$ENCODED\",\"sha\":\"$SHA\"}"

# Search code
curl -s "https://api.github.com/search/code?q=QUERY+repo:OWNER/REPO" -H "$H"
Confidence
87% confidence
Finding
curl -s -X PUT $BASE/repos/OWNER/REPO/contents/PATH -H "$H" -d "{\"message\":\"update\",\"content\":\"$ENCODED\",\"sha\":\"$SHA\"}" # Search code curl -s "https://api.github.com/search/code?q=QUERY+r

External Transmission

Medium
Category
Data Exfiltration
Content
ENCODED=$(echo -n "${NEW_CONTENT}" | base64 -w0)

curl -s -X PUT "https://api.github.com/repos/myorg/myrepo/contents/README.md" \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -d "{
Confidence
86% confidence
Finding
https://api.github.com/

Credential Access

High
Category
Privilege Escalation
Content
- Repository metadata
- Labels management

All requests use **Bearer token authentication** with a GitHub Personal Access Token (PAT). The base URL is `https://api.github.com`.

---
Confidence
93% confidence
Finding
Access Token

Session Persistence

Medium
Category
Rogue Agent
Content
- **description:** Operate GitHub repositories, issues, pull requests, files, and code search using the GitHub REST API via curl. Requires a GitHub Personal Access Token (PAT).
- **trigger phrases:** []
- **trigger phrases (natural English, ≥10):**
  - "create a GitHub issue"
  - "open an issue on"
  - "comment on the PR"
  - "close the issue"
Confidence
79% confidence
Finding
create a GitHub issue" - "open an issue on" - "comment on the PR" - "close the issue" - "list all issues in" - "show me the pull requests" - "get the contents of a file in" - "search for

Session Persistence

Medium
Category
Rogue Agent
Content
## 7. Installation Guide

### Step 1 — Create a GitHub PAT

1. Navigate to: https://github.com/settings/tokens
2. Click **Generate new token (classic)** or **Generate new token (fine-grained)**.
Confidence
85% confidence
Finding
Create a GitHub PAT 1. Navigate to: https://github.com/settings/tokens 2. Click **Generate new token (classic)** or **Generate new token (fine-grained)**. 3. Name: `openclaw-github-skill` 4. Expirati

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:64

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:565