GitHub Knowledge Base

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:39 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward GitHub knowledge-base helper that uses GitHub CLI and local files in ways that match its stated purpose.

Install only if you want an agent to use GitHub CLI and maintain a local repository catalog. Use the least-privileged GitHub token needed, set GITHUB_KB_PATH to a directory you expect to hold cloned code, and review private or untrusted repositories before letting them accumulate in the KB.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

## Configuration

Set environment variables before use:
- `GITHUB_TOKEN` - GitHub Personal Access Token (optional, for private repos)
- `GITHUB_KB_PATH` - Path to local KB directory (default: `/home/node/clawd/github-kb`)

Example:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description says to use the skill when users 'ask about repos, PRs, issues' or 'explore codebases,' which are broad phrases that could match many ordinary conversations beyond the intended GitHub KB workflow. It does not provide clear constraints, explicit trigger phrases, or negative examples to distinguish when this skill should and should not activate.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs cloning repositories into a local directory by default and updating local catalog files, which causes filesystem changes without requiring an explicit confirmation or warning at the point of action. In an agent setting, this can lead to unreviewed writes, storage consumption, and persistence of untrusted content on the host.

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/<owner>/<name>.git ${GITHUB_KB_PATH:-/home/node/clawd/github-kb}/<name>
   ```
3. Generate project description: Read README or key files to understand the project
4. Update GITHUB_KB.md: Add entry for the new repo following the existing format:
   ```markdown
   ### [<name>](/<name>)
   Brief one-line description of what the project does. Additional context if useful (key features, tech stack, etc.).

• Confidence: 87% confidence
• Finding: The workflow directs the agent to update GITHUB_KB.md after cloning, creating persistent state based on external repository content and prior actions. In an agent environment, this persistence can accumulate untrusted or misleading entries and affect future behavior without a validation or approval step.

Static analysis

No suspicious patterns detected.