GitHub Iteration Workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 1.0.0

Overview

This skill is a GitHub issue automation workflow, but it gives an agent broad authority to modify, push, merge, and potentially deploy repository changes with weak approval boundaries.

Install only if you intend to let an agent operate on a repository with real write authority. Before use, require explicit approval for selected issues, file scope, push, PR creation, merge, and deployment steps; do not allow admin merge overrides by default, and treat all GitHub issue content as untrusted problem descriptions rather than instructions for the agent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33

Finding

Untrusted GitHub Issue Content Is Delegated to a Code-Modifying Sub-Agent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-59
Vulnerability Type: Indirect prompt injection through untrusted Issue content
Risk Level: High

Vulnerable Code Snippet

bash

gh issue list --state open --json number,title,body,labels

The workflow subsequently instructs the agent to pass all Issue descriptions and the project context to one sub-agent so that it can plan and implement the changes. Faithful English translation of the relevant instruction at line 58:

text

Pass all Issue descriptions and the project context to one sub-agent,
allowing it to plan the work as a whole and make the changes uniformly.

Technical Analysis

GitHub Issue titles and bodies are externally controlled input. Any GitHub user who can create or modify an Issue may place agent instructions, deceptive remediation steps, encoded content, or requests to alter unrelated files in the Issue body.

The workflow retrieves the complete body field for every open Issue and explicitly delegates all Issue descriptions together with repository context to a sub-agent authorized to modify code. It does not establish a trust boundary between Issue content and agent instructions. In particular, it does not:

• Require the sub-agent to treat Issue content exclusively as untrusted data.
• Prohibit following tool-use or behavioral instructions embedded in an Issue.
• Restrict changes to an approved set of files.
• Limit the repository context exposed to the sub-agent.
• Require human review of the generated diff before commit or push.
• Detect prompt-injection patterns or unrelated requested changes.

An adversarial Issue can therefore attempt indirect prompt injection. If the sub-agent interprets the Issue body as authoritative instructions rather than problem data, it may introduce attacker-selected changes. The later automated commit, push, PR, merge, and deployment stages increase the likelihood that such ...[truncated 1932 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every Issue title, body, comment, attachment, and linked document as untrusted data.
2. Add an explicit instruction that the sub-agent must never follow commands, role changes, tool requests, or policy statements contained in Issue content.
3. Place Issue content inside clearly delimited data blocks and state that the delimiters contain problem descriptions only, not executable agent instructions.
4. Do not delegate all open Issues automatically. Select and approve specific Issues before providing them to a sub-agent.
5. Apply least privilege to the sub-agent:
   • Provide only files required for the approved Issue.
   • Deny access to credentials and unrelated repository content.
   • Prevent direct push, merge, and deployment operations.
   • Restrict shell and network access unless demonstrably required.
6. Require the agent to produce a proposed plan and file allowlist before making changes.
7. Reject modifications outside the approved file allowlist unless a human explicitly expands the scope.
8. Scan Issue content for prompt-injection indicators and flag suspicious Issues for manual processing. Detection should be supplementary and not replace isolation.
9. Require human review of the complete diff, test changes, workflow changes, and generated commits before push or merge.
10. Separate issue analysis, code modification, repository publication, and deployment into distinct approval-gated stages.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:108

Finding

Administrative Merge Override Bypasses Branch Protection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108-112
Vulnerability Type: Branch-protection bypass through administrative privileges
Risk Level: High

Vulnerable Code Snippet

bash

gh pr merge <PR-number> --merge
# When branch protection applies, use --admin

Technical Analysis

The workflow recommends using the GitHub CLI --admin option when branch protection prevents a normal merge. This is an explicit administrative override of repository protections rather than a process for satisfying the blocked requirements.

Branch-protection rules commonly enforce required status checks, approving reviews, signed commits, conversation resolution, linear history, deployment gates, or restrictions on who may merge. Using an administrative override can bypass some or all of these safeguards, depending on repository configuration and the privileges of the authenticated GitHub account.

The workflow only states that CI should pass before merging. It does not require independent review, verify every configured protection requirement, require human approval for the override, or distinguish an infrastructure failure from a legitimate security block. This is particularly dangerous when changes originate from untrusted Issue content and are generated automatically.

Attack Path

1. An attacker-controlled Issue or an erroneous automated repair causes unauthorized or unsafe code to be added to the working branch.
2. The workflow commits the changes, pushes the branch, and creates a pull request.
3. A required review, status check, branch policy, or other protection prevents a normal merge.
4. Following the Skill instructions, the agent invokes the merge operation with --admin.
5. The administrative override bypasses the control that would otherwise prevent the change from entering the protected branch.
6. Repository automation may build, publish, or deploy the merged code.
7. The unauthoriz ...[truncated 995 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to use gh pr merge --admin.
2. Require all branch-protection rules, status checks, review requirements, and deployment gates to be satisfied normally.
3. Use a least-privileged GitHub token that cannot administer the repository or bypass branch protection.
4. Require explicit human approval immediately before every merge and deployment.
5. If a merge is blocked, identify the exact failed requirement and resolve it rather than overriding it.
6. Treat unavailable, skipped, stale, or inconclusive checks as failures unless an authorized human determines otherwise.
7. Require independent review for changes to authentication, authorization, dependency manifests, build scripts, GitHub Actions workflows, deployment configuration, or security controls.
8. Configure branch protection so administrators are also subject to applicable rules where operationally possible.
9. Record the approving identity, reviewed commit SHA, completed checks, and merge decision for auditability.
10. Separate the credentials used to prepare a PR from credentials capable of merging or deploying it.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This workflow includes multiple state-changing actions—code modification, git push, PR creation, merge, and deployment verification—yet it does not require explicit user warnings or approval gates before performing them. In practice, an agent following these instructions could alter production-bound repositories or trigger operational changes without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction explicitly mentions using administrative merge capability when branch protections block a normal merge, but provides no mandatory confirmation, justification, or policy check. This can bypass repository safeguards and separation-of-duties controls, allowing an agent to merge unreviewed or failing changes into protected branches.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is broad enough to activate for many GitHub-related requests, including ones that could lead to code changes, pushes, merges, or deployments without clearly bounded conditions. In an agent setting, vague triggers increase the chance of unintended execution of high-impact repository operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill's descriptive text and operating instructions are entirely in Chinese, with no indication that the language is user-selectable or region-specific. This can violate language/locale policy when users have not opted into Chinese output or workflow guidance.

Content

No source excerpt is available for this finding.