GitHub Chat Assistant (Whatsapp)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:39 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent GitHub chat-ops purpose, but it asks users to share powerful GitHub tokens in chat and stores repository data and long-lived secrets in unsafe local patterns.

Review this skill before installing. Use only fine-grained, repository-limited, short-lived GitHub credentials, avoid pasting tokens into normal chat, do not store long-lived tokens in plaintext env files, and require explicit confirmation before any issue creation, issue update, or comment. Treat any /tmp cache examples as unsafe for private repositories unless replaced with a private, per-session temp directory and cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16

Finding

Insecure Collection and Handling of GitHub Personal Access Tokens

Content

View full analysis

" ``` - Never save tokens to disk or log files. When finished, run `unset GITHUB_TOKEN`. ``` `SKILL.md:69-73`: ```markdown ## 8. Daily automation & cron jobs - Store long-lived secrets outside the skill (e.g., `.env.github-chat-ops` with `GITHUB_CHAT_OPS_TOKEN`, repo, timezone). - Build reusable scripts under `scripts/` (see `scripts/github_chat_ops_daily.py`) that load env vars, call the same APIs, and print a ready-to-send summary. - When scheduling via `cron`, run the script from the workspace root, capture stdout verbatim for the message, and surface errors if the script exits non-zero. - Let end users customize repo/timezone by editing the env file; document that in the skill release notes so downstream consumers know where to look. ``` `references/github-api-cheatsheet.md:3-8`: ```bash ## Shared curl flags ```bash BASE="https://api.github.com" OWNER="" REPO="" AUTH=(-H "Authorization: Bearer $GITHUB_TOKEN" -H "Accept: application/vnd.github+json") ``` ``` `references/github-api-cheatsheet.md:97`: ```bash - Always `unset GITHUB_TOKEN` after finishing: `unset GITHUB_TOKEN && history ...[truncated 3076 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Private Repository Data Written to Predictable Shared Temporary Paths

Content

View full analysis

/...`) so subsequent lookups avoid extra API calls. ``` `references/github-api-cheatsheet.md:16-20`: ```bash SINCE="2025-12-01T00:00:00Z" UNTIL="2025-12-08T00:00:00Z" curl "${BASE}/repos/${OWNER}/${REPO}/commits?since=${SINCE}&until=${UNTIL}" "${AUTH[@]}" > /tmp/commits.json ``` `references/github-api-cheatsheet.md:26-29`: ```bash curl "${BASE}/repos/${OWNER}/${REPO}/issues?state=all&since=${SINCE}&per_page=100" "${AUTH[@]}" > /tmp/issues.json ``` `references/github-api-cheatsheet.md:34-41`: ```bash cat <<'JSON' > /tmp/new-issue.json { "title": "Investigate payment webhook timeouts", "body": "Summary...", "labels": ["bug", "priority:high"], "assignees": ["octocat"] } JSON ``` `references/github-api-cheatsheet.md:72-76`: ```bash FILE="src/app.py" curl -H "Accept: application/vnd.github.raw" \ "${BASE}/repos/${OWNER}/${REPO}/contents/${FILE}?ref=main" \ "${AUTH[@]}" > /tmp/app.py ``` `references/github-api-cheatsheet.md:87-89`: ```bash SHA="a251e65" curl "${BASE}/repos/${OWNER}/${REPO}/commits/${SHA}" "${AUTH[@]}" > /tmp/commit.json ``` ### Technical Analysis The instructions repeatedly write GitHub API responses and source files to fixed, predictable paths in the shared `/tmp` namespace. No secure directory creation, restrictive permission setup, symlink protection, exclusive file creation, lifecycle cleanup, or error-safe deletion is specified. The cached data may include private source co ...[truncated 2329 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill is designed around obtaining and using a user's personal access token, which is credential handling with direct authority over a GitHub repository. In this context, the risk is elevated because the token is requested through chat and then used for potentially write-capable operations, making theft or misuse impactful.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

- "Tell me what changed recently and who did it."
- "Create an issue describing X."
- "Follow up on existing issues or PRs."
The workflow relies entirely on the GitHub REST API using a personal access token (PAT) the requester provides during the chat.

## 1. Gather prerequisites every session
1. **Repo identifier** – ask for full URL or `owner/name`.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation presents tokens as temporary and disposable, then later instructs users to keep long-lived secrets in an env file for automation. This contradiction can mislead operators into unsafe handling of credentials and normalize persistent secret storage without clearly changing the security assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs users to send a personal access token through chat, creating a direct credential-exposure path through messaging history, platform retention, screenshots, and intermediary systems. Even if described as temporary, transmitting secrets via chat is inherently risky and may leak repository access to unintended parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends storing long-lived secrets in a plaintext env file for recurring automation without strong safeguards. Persistent local secret storage significantly increases the blast radius of host compromise, accidental file disclosure, source-control mistakes, and operational misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file says to use the skill whenever a non-technical person needs 'lightweight GitHub help without cloning or forking a repo,' then gives only broad example asks. That activation scope is expansive and lacks clear boundaries or negative examples, which could cause the skill to be invoked for many general GitHub-related conversations beyond the intended chat-ops workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Saving raw GitHub API responses locally can persist sensitive repository metadata, issue content, and potentially code-related information beyond the immediate task. Without warnings or handling constraints, these files may be accessible to other local processes, included in backups, or accidentally reused or disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Caching fetched repository files under /tmp creates local persistence of potentially sensitive source code and configuration data. On multi-user or poorly isolated systems, temp directories can be inspected, retained, or harvested, turning a transient read operation into a broader data-exposure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from ephemeral, user-provided session tokens to persistent automation using long-lived secrets and reusable scripts, which materially changes the trust and attack model. Storing durable credentials for unattended execution increases the chance of credential theft, misuse, and unauthorized repository actions if the host, workspace, or logs are exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference includes mutation operations—creating issues, updating issues, and posting comments—without requiring explicit user confirmation or warning about side effects. In a chat-ops setting for non-technical users using temporary personal tokens, this materially increases the chance of unintended writes to a live repository, spam, erroneous issue closure, or unauthorized workflow changes triggered by comments/integrations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/github-api-cheatsheet.md (reported line 45)May include surrounding context.

md

"assignees": ["octocat"]
}
JSON
curl -X POST "${BASE}/repos/${OWNER}/${REPO}/issues" \
     "${AUTH[@]}" \
     -H "Content-Type: application/json" \
     --data @/tmp/new-issue.json

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says to mention timestamps in the user's timezone, but then defaults to 'Africa/Lagos unless told otherwise.' This introduces a locale choice without explicit user opt-in and may misalign with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a skill focused on pulling repository status, summarizing who did what and when, and creating or following up on issues through the GitHub API. This reference material additionally documents browsing repository contents, fetching raw files, whole-tree snapshots, and per-commit patch inspection, which expands the behavior into source-code/content inspection rather than just status and issue chat-ops.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The cheatsheet mixes a local git command into an API-only workflow: git rev-parse HEAD is used to build a GitHub API request. In a chat-driven agent context, this can cause the agent to consult the local working directory or execute environment-dependent commands, creating a risk of acting on the wrong repository state or using unintended local resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language guidance mandates a specific timezone for summaries regardless of user preference or context. This is a locale-specific instruction without opt-in or justification, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.