Security audit

Issue Prioritizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent GitHub issue triage helper, but its history cleanup can delete unrelated local directories if pointed at a broad path.

Install only if you are comfortable with local run files being created and pruned. Avoid passing --history-dir as your home directory, a project root, /tmp, or any shared directory; use a dedicated empty state directory for this skill and keep --retain at a conservative value until the cleanup logic is constrained.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch-issues.sh:838
Finding: Arbitrary Recursive Deletion Through Unrestricted History Directory Retention
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill prioritizes GitHub issues and provides ranked triage recommendations in a read-only manner. The supplied code chunk does not implement prioritization or contributor recommendations; instead, it is a test harness for another script (fetch-issues.sh). Its primary behavior is validating data collection and pipeline mechanics: mocking gh, checking structured error output, excluding issues with linked open PRs, handling --resume and --diff-from, pruning retained run directories, and resetting errors.log. While these behaviors may support a larger issue-triage system and remain read-only with respect to GitHub, the actual code’s purpose is materially different from the declared user-facing capability. Therefore this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/fetch-issues.sh (reported line 647)May include surrounding context.
sh
# ── Step 4: Split into batches (by size, not by count) ─────────────────────── rm -f "$WORKDIR"/batches/batch-*.json "$WORKDIR"/batch-*.json 2>/dev/null || true if [[ "$REMAINING" -eq 0 ]]; then NUM_BATCHES=0

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to execute shell commands (bash, cat) and use the gh CLI, but it declares no permissions or allowed-tools scope. That creates an implicit capability boundary bypass: a caller may invoke a skill that appears harmless/read-only while it can access the shell and local files, increasing the chance of unintended command execution or data exposure if any inputs are attacker-controlled.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatic pruning of workdirs is an unnecessary destructive capability for a fetch/triage helper and expands the blast radius beyond data collection. If HISTORY_DIR is pointed at an unexpected location, the retention loop can delete directories the user did not intend this skill to manage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script enforces retention by deleting historical run directories with rm -rf, which contradicts the skill's stated read-only posture. While it does not mutate the GitHub repository, it does perform destructive local filesystem actions that can remove cached analysis artifacts or user data if the history directory is shared or misconfigured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script deletes prior run directories without any interactive confirmation, dry-run, or prominent warning. In an agent skill context, silent destructive behavior is more dangerous because callers may assume 'read-only' means no local state will be removed, making accidental data loss harder to notice or prevent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The header comment describes the script as fetching GitHub issues, detecting linked PRs, and splitting into batches, implying a preparatory/read-oriented tool. Later code silently prunes older run directories, which contradicts that stated intent by adding destructive maintenance behavior not disclosed in the documentation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.