ClawHub
Back to skill

Security audit

Issue Prioritizer

Security checks across malware telemetry and agentic risk

Overview

This appears to be a GitHub issue triage helper, but it stores raw issue data and includes broad local history handling that users should review before installing.

Install only if you are comfortable with the skill saving raw GitHub issue and PR content locally. Before use, check where its history directory is created, avoid pointing resume or diff options at unrelated folders, and confirm cleanup cannot delete anything outside the skill's own run-history area.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The script explicitly writes raw issue and PR data, including full bodies, to disk in files such as issues.json and prs.json. In a read-only triage skill, persistent storage of potentially sensitive issue content expands the data exposure surface, especially if issue bodies contain secrets, internal URLs, or vulnerability details; this is a scope expansion rather than a repository mutation, but still a real security/privacy concern.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill advertises read-only issue prioritization, but it also implements local run-history and retention behavior unrelated to the core task. Managing historical runs increases local data accumulation and broadens side effects beyond analysis, which makes accidental exposure or unsafe file operations more likely in agent environments.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script allows --resume and --diff-from to reference arbitrary local directories, then reads JSON files from those paths and may later treat them as part of its workflow. In an agent setting, this can be abused to make the skill inspect unrelated local filesystem locations outside the intended repository-triage scope, creating a local file exposure and scope-bypass risk.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The retention routine enumerates directories under HISTORY_DIR and deletes older ones with rm -rf, which is a destructive local filesystem action inconsistent with the skill's read-only positioning. If HISTORY_DIR is user-controlled or misconfigured, the script can delete unintended directories, and in agent environments any deletion capability materially raises risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.