GitHub Passwordless Setup

• Analyzed: May 12, 2026, 4:29 AM
• Findings: 1
• Version: 1.0.0
• Hash: 76a17064183c532026494587a9ed3f6f31f9f476345540cf52b8865294997df6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle aims to provide a convenient passwordless GitHub setup. While its stated purpose is benign, it contains several significant security vulnerabilities and anti-patterns. The `SKILL.md` and `README.md` files instruct the user/agent to execute a remote script via `curl | bash` (supply chain risk). The `setup.sh` script generates SSH keys without a passphrase by default (`-N ""`) and recommends GitHub Personal Access Tokens (PATs) with overly broad scopes (e.g., `repo` all sub-scopes, `delete_repo`, `admin:org`) and 'No expiration' for convenience, significantly increasing the blast radius if the token is compromised. These are not indicators of intentional malice, but rather critical security flaws that make the skill suspicious.