T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:68- Finding
Hardcoded GitHub Identity and Push Destination May Redirect Committed Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
GitHub Personal Repo Publisher
Security checks for vulnerabilities and agentic risk
Overview
The skill performs a legitimate GitHub publishing workflow, but it hardcodes a specific GitHub account, SSH alias, and 1Password PAT reference while allowing remote rewiring and code push.
Review this carefully before installing. Only use it if `grey0758`, `github-grey0758`, and the named 1Password PAT are intentionally your own configured account details. Before any run, confirm the GitHub login, repository owner/name, visibility, current `origin`, final push URL, and branch to be pushed; avoid using it on proprietary or sensitive repositories unless those checks pass.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises a workflow that creates a GitHub repository, rewires remotes, and pushes history, but it does not prominently warn that these actions can publish code externally and permanently alter a local repository's remote configuration. In a skill meant to automate repo publication, lack of explicit consent and safety messaging increases the chance of accidental disclosure of proprietary code or pushes to an unintended destination.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ssh -T git@github-grey0758 git ls-remote git@github-grey0758:grey0758/your-repo.git HEAD TOKEN="$(op read 'op://OpenClaw/GitHub Fine-Grained PAT - Repo Admin - grey0758/credential')" curl -fsSL -X POST -H 'Accept: application/vnd.github+json' -H "Authorization: Bearer $TOKEN" https://api.github.com/user/repos -d '{"name":"your-repo","private":true}' git -C /path/to/project remote add origin git@github-grey0758:grey0758/your-repo.git git -C /path/to/project push -u origin main
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ssh -T git@github-grey0758 git ls-remote git@github-grey0758:grey0758/your-repo.git HEAD TOKEN="$(op read 'op://OpenClaw/GitHub Fine-Grained PAT - Repo Admin - grey0758/credential')" curl -fsSL -X POST -H 'Accept: application/vnd.github+json' -H "Authorization: Bearer $TOKEN" https://api.github.com/user/repos -d '{"name":"your-repo","private":true}' git -C /path/to/project remote add origin git@github-grey0758:grey0758/your-repo.git git -C /path/to/project push -u origin main
text
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README references SSH-managed account access and a 1Password-stored GitHub PAT without warning users not to expose, print, log, or paste credentials during execution. While the text does not leak a secret directly, normalizing credential handling without privacy guidance can lead to unsafe operator behavior and inadvertent credential disclosure in terminals, logs, or agent transcripts.
- Content