T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:21- Finding
Mutable Remote Script Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
GitHub Passwordless Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its GitHub authentication purpose, but it asks users to run mutable remote shell code and create broad, durable GitHub credentials with account-changing verification steps.
Install only after reviewing the scripts locally. Avoid the curl-to-bash command, prefer a passphrase-protected SSH key, use a fine-grained short-lived token with only the permissions you need, and do not run the create/delete repository verification unless you explicitly want account-state changes.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
setup.sh:50- Finding
Authentication Setup Encourages Broad, Long-Lived Credentials and an Unencrypted SSH Key
- Content
View full analysis
/dev/null || true echo "Please paste your GitHub Personal Access Token:" gh auth login --with-token ``` The detailed instructions in `SKILL.md` additionally recommend optional classic-token scopes including: ```text repo workflow delete_repo admin:org ``` They also permit a token with no expiration. ### Technical Analysis The script forces an empty SSH private-key passphrase through `-N ""`. This provides passwordless operation but removes an important defense if the private key file is copied from the host. The documentation calls passphrases recommended elsewhere, but the automated setup does not offer that secure default. The token guidance recommends all classic `repo` sub-scopes and permits no expiration. The detailed Skill documentation also presents `workflow`, `delete_repo`, and `admin:org` scopes. These capabilities are not inherently required for ordinary SSH-based Git push, pull, and clone operations. Repository deletion, workflow modification, and organization administration should only be granted for explicitly selected workflows. A non-expiring, broad classic PAT increases both the useful lifetime and authorization scope of a stolen credential. This confli ...[truncated 1600 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
setup.sh:193- Finding
Verification Performs Unnecessary Public Repository Creation and Destructive Deletion
- Content
View full analysis
/dev/null; then echo -e "${GREEN}✅ Repository creation: Working${NC}" # Delete test repo if gh repo delete "$(gh api user --jq '.login')/$TEST_REPO" --yes &> /dev/null; then echo -e "${GREEN}✅ Repository deletion: Working${NC}" fi fi ``` From `verify.sh`: ```bash TEST_REPO="test-verify-$(date +%s | tail -c 6)" if gh repo create "$TEST_REPO" --public --description "Test" &> /dev/null; then echo -e "${GREEN} ✅ Create repository: Working${NC}" if gh repo delete "$(gh api user --jq '.login')/$TEST_REPO" --yes &> /dev/null; then echo -e "${GREEN} ✅ Delete repository: Working${NC}" else echo -e "${YELLOW} ⚠️ Delete repository: Failed${NC}" fi else echo -e "${RED} ❌ Create repository: Failed${NC}" ERRORS=$((ERRORS + 1)) fi ``` ### Technical Analysis Both setup and verification perform externally visible, state-changing operations against the user's GitHub account. They create a public repository and then attempt to delete it without a separate confirmation at the point of mutation. Repository creation and deletion are not necessary to verify SSH authentication, GitHub CLI authentication, or basic API connectivity. Read-only operations such as `ssh -T`, `gh auth status`, and `gh api user` already establish those conditions. The test also creates pressure to grant repository creation and deletion privileges solely so verification can pass. If deletion fails because of missing permission, network failure, interruption, rate limiting, or API errors, the public test repository remains in the user's account. ### Attack Pat ...[truncated 1327 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (78)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Configures **complete passwordless authentication** for GitHub using: 1. **SSH Keys** - Zero-password Git operations (push/pull/clone) 2. **Personal Access Token** - Zero-password repository management **One-time setup, lifetime convenience!**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Configures **complete passwordless authentication** for GitHub using: 1. **SSH Keys** - Zero-password Git operations (push/pull/clone) 2. **Personal Access Token** - Zero-password repository management **One-time setup, lifetime convenience!**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Configures **complete passwordless authentication** for GitHub using: 1. **SSH Keys** - Zero-password Git operations (push/pull/clone) 2. **Personal Access Token** - Zero-password repository management **One-time setup, lifetime convenience!**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh Configures **complete passwordless authentication** for GitHub using: 1. **SSH Keys** - Zero-password Git operations (push/pull/clone) 2. **Personal Access Token** - Zero-password repository management **One-time setup, lifetime convenience!**
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The use of '| bash' chains network retrieval directly into shell execution, eliminating the user's opportunity to inspect the contents before running them. This pattern is especially risky in setup skills because it normalizes blind execution and can be abused for command chaining, persistence, or credential theft if the remote script is ever altered maliciously.
- Content
⚡ Quick Start
bash curl -fsSL https://raw.githubusercontent.com/happydog-intj/github-passwordless-setup/master/setup.sh | bash✨ Before vs After
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README instructs users to fetch and immediately execute a remote shell script via
curl ... | bash, which prevents review of the script before execution and gives the remote content full code-execution capability on the user's machine. In the context of a credential-setup skill, this is especially dangerous because the script likely handles SSH keys and GitHub authentication state, so a compromised script or repository could exfiltrate tokens, private keys, or alter git/gh configuration.- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| bashpipeline removes the user's opportunity to inspect downloaded content and immediately turns a network fetch into arbitrary shell execution. In a setup tool that manages passwordless GitHub access, this materially increases risk because a malicious script could silently harvest credentials or implant persistence in shell and git configuration.- Content
⚡ 快速开始
bash curl -fsSL https://raw.githubusercontent.com/happydog-intj/github-passwordless-setup/master/setup.sh | bash✨ 配置前后对比
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill’s stated purpose is authentication setup, but it also performs active verification with side effects, including creating and deleting a repository on the user’s GitHub account. That mismatch can cause unexpected account actions and broadens the trust required from the user beyond simple local configuration.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: github-passwordless-setup description: Complete GitHub passwordless authentication setup using SSH keys and Personal Access Tokens. Never type passwords or re-authenticate for Git operations and GitHub API calls. --- # GitHub Passwordless Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: github-passwordless-setup description: Complete GitHub passwordless authentication setup using SSH keys and Personal Access Tokens. Never type passwords or re-authenticate for Git operations and GitHub API calls. --- # GitHub Passwordless Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: github-passwordless-setup description: Complete GitHub passwordless authentication setup using SSH keys and Personal Access Tokens. Never type passwords or re-authenticate for Git operations and GitHub API calls. --- # GitHub Passwordless Setup
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
curl ... | bashis a classic dangerous chaining pattern because it turns remote content into immediate code execution without inspection, provenance validation, or pinning. In this skill context, the command is especially risky because it is presented as the primary quick-start path.- Content
One-line automated setup:
bash curl -fsSL https://raw.githubusercontent.com/happydog-intj/github-passwordless-setup/master/setup.sh | bashOr follow the manual steps below.
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Linux (Debian/Ubuntu):
bash type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Linux (Debian/Ubuntu):
bash type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Linux (Debian/Ubuntu):
bash type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Linux (Debian/Ubuntu):
bash type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Piping remotely fetched content directly into a privileged writer (
curl ... | sudo dd) reduces user visibility into what is being installed and amplifies the impact of a compromised upstream or network path. While common in repository setup snippets, it is still an unsafe pattern because untrusted bytes are immediately committed under elevated privileges.- Content
Linux (Debian/Ubuntu):
bash type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
Piping repository configuration text into
sudo teewrites privileged configuration non-interactively and encourages users not to inspect the exact file contents before installation. In combination with other setup steps, this increases the chance of silently adding an unintended package source.- Content
type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null sudo apt update sudo apt install gh -y
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If empty or error, add your key
ssh-add ~/.ssh/id_ed25519
macOS: Add to Keychain permanently
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If empty or error, add your key
ssh-add ~/.ssh/id_ed25519
macOS: Add to Keychain permanently
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ssh-add ~/.ssh/id_ed25519
macOS: Add to Keychain permanently
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
text **Problem: "Host key verification failed"**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The
GH_TOKENexport example promotes storing a sensitive PAT in an environment variable, which can be exposed to subprocesses, debugging tools, logs, and misconfigured shell profiles. In contrast, theGIT_SSH_COMMANDportion is not the issue; the danger is teaching persistent token exposure patterns.- Content
export GH_TOKEN="ghp_xxxxx" # Auto-auth for gh commands
Git
export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_ed25519" # Force specific key
text Add to your shell profile (`~/.bashrc`, `~/.zshrc`):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 81% confidence
- Finding
Prompting the user to paste a GitHub Personal Access Token into the terminal is credential handling that increases exposure risk, especially when the script recommends broad
repoaccess and long-lived tokens. In this skill context, collecting privileged credentials is expected but still more dangerous because the token can enable account-wide API actions beyond simple Git transport.- Content
sh # Logout any existing sessions gh auth logout -h github.com 2>/dev/null || true echo "Please paste your GitHub Personal Access Token:" gh auth login --with-token # Set git protocol to SSH
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Check 1: SSH Key echo -e "${YELLOW}1️⃣ Checking SSH Key...${NC}" if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then echo -e "${GREEN} ✅ SSH key exists${NC}" # Test connection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Check 1: SSH Key echo -e "${YELLOW}1️⃣ Checking SSH Key...${NC}" if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then echo -e "${GREEN} ✅ SSH key exists${NC}" # Test connection
Static analysis
No suspicious patterns detected.