GitHub API 工具

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent GitHub helper, but it asks for broad GitHub token access and documents repository-changing actions without clear scoping or confirmation guidance.

Review this skill before installing. Use a fine-grained, short-lived GitHub token limited to the repositories and actions you actually need, protect the config file, and require explicit confirmation before creating, closing, editing, merging, reviewing, or dispatching workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Plaintext Storage of an Overprivileged GitHub Access Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–48
Vulnerability Type: Plaintext sensitive credential storage and excessive token permissions
Risk Level: Medium

Vulnerable Code Snippet

markdown

**Token permission requirements:**
- `repo` - Full repository operations
- `read:user` - Read user information
- `workflow` - GitHub Actions operations

json

{
  "env": {
    "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx"
  }
}

Technical Analysis

The Skill instructs users to persist a GitHub personal access token directly in ~/.openclaw/openclaw.json. Although the displayed token is a placeholder rather than an exposed live credential, following this configuration pattern places the actual token in a plaintext file.

The requested classic-token scopes are also broad. The repo scope may provide read and write access to private repositories, while workflow permits GitHub Actions workflow operations. These permissions are prescribed globally rather than being limited to the repositories and operations required for a particular task.

The documentation does not require restrictive file permissions, token expiration, repository restrictions, secret-manager integration, or fine-grained permissions. Consequently, another local user or process, an insecure backup, or an accidentally published configuration could disclose a reusable and highly privileged credential.

Attack Path

1. A user follows the documented instructions and writes a real GitHub token into ~/.openclaw/openclaw.json.
2. A local process, another user with file access, an untrusted plugin, a backup system, or an accidentally committed configuration obtains the plaintext token.
3. The attacker extracts the GITHUB_TOKEN value and uses it to authenticate to the GitHub API.
4. The attacker performs operations allowed by the token's scopes and repository authorization.
5. Depending on the token's effective access, the attacker reads private repository content, mo ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace classic broadly scoped personal access tokens with fine-grained GitHub tokens.
2. Restrict each token to the minimum required repositories and operations.
3. Request permissions per use case instead of prescribing repo and workflow globally.
4. Store credentials in an operating-system keychain or dedicated secret manager and inject them only at runtime.
5. If file-based storage is unavoidable, require owner-only file permissions, such as mode 0600, and ensure the configuration is excluded from version control and insecure backups.
6. Use short token expiration periods and establish regular rotation and immediate revocation procedures.
7. Document how users can verify the token's effective repository access and permissions before use.
8. Avoid printing tokens in command output, logs, diagnostics, or error messages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents state-changing GitHub actions such as creating issues, closing issues, editing issues, creating PRs, and merging PRs without an explicit warning that these operations modify remote repositories and may be irreversible or workflow-impacting. In an agent context, this increases the chance of unintended destructive or unauthorized changes if a user prompt is ambiguous or if the agent acts without clear confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow dispatch feature triggers remote automation in GitHub Actions, which can execute code, consume secrets, and cause downstream deployment or CI/CD effects. Documenting this capability without a prominent warning or confirmation requirement is risky in an agent skill because a simple request could trigger sensitive automation in a repository.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

# 格式
curl -H "Authorization: token $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github.v3+json" \
     https://api.github.com/{endpoint}

# 示例：获取仓库信息
curl -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

# 格式
curl -H "Authorization: token $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github.v3+json" \
     https://api.github.com/{endpoint}

# 示例：获取仓库信息
curl -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

# 格式
curl -H "Authorization: token $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github.v3+json" \
     https://api.github.com/{endpoint}

# 示例：获取仓库信息
curl -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

# 格式
curl -H "Authorization: token $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github.v3+json" \
     https://api.github.com/{endpoint}

# 示例：获取仓库信息
curl -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

# 格式
curl -H "Authorization: token $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github.v3+json" \
     https://api.github.com/{endpoint}

# 示例：获取仓库信息
curl -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

bash

# 查看仓库
curl -s -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/{owner}/{repo}

# 列出 open issues
curl -s -H "Authorization: token $GITHUB_TOKEN" "https://api.github.com/repos/{owner}/{repo}/issues?state=open"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description and instructions are presented entirely in Chinese, with no indication that users may choose another language or that the locale is intentionally restricted. Under the policy, forcing a specific language without opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.