T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
index.js:125- Finding
Undocumented Authenticated Pull-Request Creation Capability
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Github Assistant 2.0.1
Security checks for vulnerabilities and agentic risk
Overview
This GitHub skill mostly fits its purpose, but it exposes authenticated GitHub write actions, including an undocumented pull-request action, without clear in-skill approval controls.
Install only if you are comfortable giving the skill GitHub write access. Prefer a fine-grained token limited to selected repositories and needed permissions, and require your agent to ask before creating repositories, issues, or pull requests, especially because pull-request creation is exposed by the code but not clearly documented.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
api.js:171- Finding
Unrestricted Issue Fields Can Override Validated Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - OpenClaw gateway running - Node.js 18+ - GitHub account with a Personal Access Token (PAT) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - OpenClaw gateway running - Node.js 18+ - GitHub account with a Personal Access Token (PAT) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - OpenClaw gateway running - Node.js 18+ - GitHub account with a Personal Access Token (PAT) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - OpenClaw gateway running - Node.js 18+ - GitHub account with a Personal Access Token (PAT) ## Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - OpenClaw gateway running - Node.js 18+ - GitHub account with a Personal Access Token (PAT) ## Setup
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description understates or inconsistently describes behavior, including repository creation and other higher-impact actions. In security-sensitive agent systems, description-behavior mismatch is dangerous because users may authorize a skill believing it is lower risk than its actual capabilities, enabling unintended write actions against GitHub resources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The declared description understates or inconsistently describes behavior, including repository creation and other higher-impact actions. In security-sensitive agent systems, description-behavior mismatch is dangerous because users may authorize a skill believing it is lower risk than its actual capabilities, enabling unintended write actions against GitHub resources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description understates or inconsistently describes behavior, including repository creation and other higher-impact actions. In security-sensitive agent systems, description-behavior mismatch is dangerous because users may authorize a skill believing it is lower risk than its actual capabilities, enabling unintended write actions against GitHub resources.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - 📋 **List Repos** — View your repositories with filters - 📊 **Get Repo Details** — Stars, forks, language, last updated - 🔄 **Check CI Status** — Monitor CI/CD pipelines - 📝 **Create Issues** — Open issues from conversation - 📁 **Create Repos** — Create new repositories - 🔍 **Search Repos** — Find repos by name/query - 📊 **Recent Activity** — View recent commits
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README advertises issue creation and repository creation capabilities but does not clearly warn that these are state-changing operations on the user's GitHub account. In an agent skill context, insufficient disclosure around write actions increases the risk of unintended or socially engineered destructive actions being performed with the user's token.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares access to environment/config secrets and implies networked GitHub operations, but it does not define explicit tool scope restrictions such as allowed tools or permissions. In an agent setting, missing scope boundaries can let the runtime grant broader access than the user expects, increasing the blast radius if the skill is misused or later extended.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
You: Check CI status on my main project Bot: [shows CI/CD status]
You: Create an issue about the bug Bot: [creates the issue]
text
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The declared API surface includes state-changing capabilities to create repositories and pull requests, but the manifest description only frames the skill as querying/managing repos in a more limited way and does not explicitly disclose these high-impact write actions. Hidden or under-disclosed mutating capabilities increase the risk that an agent or user invokes destructive or sensitive operations without adequate review, especially in an automation context tied to authenticated GitHub credentials.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The implemented API exposes repository creation and pull-request creation functions that are not reflected in the stated skill description, which only mentions querying repos, checking CI, creating issues, searching repos, and viewing activity. This capability mismatch can mislead users or higher-level policy/approval layers into authorizing a skill they believe is read-mostly or limited, while the code can perform additional write actions against GitHub.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This function performs a state-changing POST to GitHub's repository creation endpoint using the caller's credentials, but the code contains no built-in confirmation, dry-run mode, or warning before creating a repository. In an agent setting, that increases the risk of unintended resource creation, namespace clutter, policy violations, or abuse of the authenticated account if the action is triggered by ambiguous or manipulated instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This function creates a pull request via a POST request without any user-facing confirmation or secondary validation of the target repository, branch, or content context. In an autonomous or semi-autonomous agent workflow, that can lead to unauthorized code submission, workflow triggering, or social-engineering-style changes being proposed under the user's identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill interface exposes state-changing GitHub actions such as create_issue, create_repo, and create_pull_request without any visible confirmation, approval gate, or safety constraint in the declared action surface. In an agent setting, this increases the risk of unintended repository modifications, spam issue creation, or unauthorized workflow changes if a prompt, tool call, or compromised upstream component triggers these actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The exported skill description says only 'Query and manage GitHub repositories', while the implemented actions include create_repo, create_issue, and create_pull_request. Under-disclosing write capabilities can mislead users or orchestrators into granting or invoking a skill with broader side effects than expected, increasing the risk of unintended repository changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file exposes mutating GitHub actions that can create repositories, issues, and pull requests without any visible confirmation, approval gate, or warning at the skill-definition layer. In an agent context, natural-language prompting or misinterpretation can trigger real account changes, causing unauthorized spam, unwanted repos/PRs, or workflow disruption.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes the skill as being able to list repos, check CI status, create issues, search repos, and view recent activity. This file also defines parameters and return types for creating repositories and pull requests, which are additional write capabilities not reflected in the stated description.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The type definition includes a GitHub authentication token field, which indicates the skill may access sensitive credentials. In this file, there is no accompanying comment, docstring, or user-facing disclosure explaining credential handling or warning that authentication data may be used.
- Content
Static analysis
No suspicious patterns detected.