Security audit

gitcode-issue-workflow

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent GitCode issue-to-PR workflow, but it gives unsafe instructions for handling access tokens that could expose repository credentials.

Install only if you are comfortable correcting the credential handling yourself: prefer the authenticated GitCode CLI or a secure environment/credential store, do not put tokens in MEMORY.md, do not paste tokens into URLs, and verify the temp/ path before running cleanup commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The skill instructs users to place GitCode access tokens directly in URL query strings for API calls. Query-string tokens are commonly exposed through shell history, proxy/server logs, browser history, process listings, and diagnostic output, so this guidance can directly leak credentials.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The PR-creation fallback repeats the unsafe pattern of embedding an access token in the request URL for a write operation. This increases risk because leaked credentials could permit unauthorized repository modifications, PR creation, or broader API actions depending on token scope.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The documentation explicitly instructs storing a GitCode access token in MEMORY.md, which encourages persistent local secret storage in a general project artifact rather than a dedicated secret manager or ephemeral runtime input. In an issue/PR workflow skill, this broadens secret exposure risk because the token may be committed, indexed, surfaced to the model, or reused outside the user's intended session.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow says the GitCode token may be stored in MEMORY.md or provided by the user, but gives no warning that this is sensitive credential material. Storing tokens in a shared or persistent plaintext file can expose secrets to other tools, collaborators, logs, backups, or later prompts.

Missing User Warnings

High

Confidence: 99% confidence
Finding: These examples place the access token directly in the curl URL without warning about exposure in command history, logs, telemetry, and process inspection. Because the commands are copy-pasteable, the skill materially encourages unsafe secret handling rather than merely mentioning a theoretical risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The PR-creation fallback again embeds the token in the URL, now for a state-changing API request. This can leak a credential with write capability, enabling unauthorized PR activity or broader compromise if the token has expanded scope.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The cleanup step recommends forceful recursive deletion of temp/ without a nearby safeguard to verify the working directory or exact target path. In a workflow skill that operates across repositories and shells, a mistaken path or variable expansion could cause destructive deletion beyond intended temporary files.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The file combines two unsafe credential practices: passing access tokens in query parameters and advising storage in MEMORY.md, without warning about leakage through shell history, logs, proxies, browser history, or accidental repository commits. Because this skill automates issue and PR operations against a remote service, exposed tokens could let an attacker act as the user and read or modify repository resources.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Allowing tokens to be stored in MEMORY.md and passed around in plaintext normalizes insecure secret handling. Even if intended for convenience, it increases the chance of long-term credential retention in files, prompts, backups, and tool context accessible to others.

Ssd 3

High

Confidence: 96% confidence
Finding: The authentication guidance includes echoing a token into a login command, which can still expose the secret through shell history, transcript logging, clipboard capture, or surrounding tooling. In the broader context of this skill, it contributes to a pattern of encouraging direct secret handling in shell commands.

Ssd 3

High

Confidence: 99% confidence
Finding: This section explicitly directs use of access tokens in API query parameters, a well-known plaintext disclosure pattern. Because the skill is operational and action-oriented, users are likely to execute these commands directly, making the exposure practical rather than hypothetical.

Ssd 3

High

Confidence: 99% confidence
Finding: The PR creation fallback repeats plaintext token exposure for a write-capable request, extending the blast radius from read access to repository modification workflows. A leaked token here could be abused to create or manipulate pull requests and potentially perform other privileged API actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.