ClawHub
Back to skill

Security audit

PR + Commit Workflow

Security checks for vulnerabilities and agentic risk

Overview

This PR workflow skill is coherent, but it needs Review because it can publish full prompt logs and local environment details into GitHub pull requests.

Install only if you are comfortable with PR bodies containing prompt transcripts and local tool details. Before using it on private, customer, security, or public repositories, require manual review of the complete PR body, omit unrelated or sensitive prompts entirely, and consider disabling terminal/system metadata publication.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
references/workflow-pr.md:20
Finding

Mandatory Full Prompt-History Publication May Expose Sensitive Information

Content
View full analysis

Vulnerability Details

File Location: references/workflow-pr.md:20-39; related instructions in SKILL.md:17-27 and output fields in references/pr-human-template.md:20-31
Vulnerability Type: Sensitive Data Exposure
Risk Level: Medium

Vulnerable Code

markdown
- Use `/tmp` + `gh pr edit --body-file` for updates.
- Create PR with `gh pr create` if not already open.
- Default PRs to draft until tests + review pass; ask user before marking ready.

## Prompt History Requirements
- Include ISO-8601 timestamps with timezone.
- Prefer agent history search tools (`cm`/`cass`, Codex logs, etc.); if unavailable, fall back to manual logs and note the fallback.
- Include the full prompt history verbatim; do not omit prompts.
- If a prompt contains sensitive info, redact only the sensitive portion and keep the entry.
- Always include Environment metadata under Prompt History:
  - Harness
  - Model
  - Thinking level
  - Terminal
  - System
- Use `scripts/build_pr_body.sh` to collect environment fields when possible.
- If any field is unknown, ask the user to fill it.
- Format prompt history as a table: `ISO-8601` | `prompt` and wrap prompts in inline code (use double backticks if the prompt contains backticks).
- For very long prompts (>200 chars), consider using heading+codeblock format instead of table rows to avoid rendering issues.

The corresponding PR template creates designated publication fields:

markdown
# Prompt History

## Environment
Harness: <value>
Model: <value>
Thinking level: <value>
Terminal: <value>
System: <value>

## Prompts
| ISO-8601 | Prompt |
| --- | --- |
| <timestamp> | `<prompt text>` |

Technical Analysis

The skill requires an agent to search local agent histories, collect the complete prompt history verbatim, and place it in a pull-request body that is published through GitHub CLI ...[truncated 2251 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make prompt-history publication explicitly opt-in rather than mandatory.
  2. Restrict history collection to prompts from the current task or session that are directly relevant to the change.
  3. Replace the default full-history requirement with a task-relevant summary or references to privately retained audit records.
  4. Require explicit user approval of the complete rendered PR body before any gh pr create or gh pr edit command.
  5. Run automated secret, credential, PII, and high-entropy-token scanning against the generated body before publication.
  6. Allow complete omission of sensitive or unrelated entries instead of requiring that every prompt remain present after partial redaction.
  7. Clearly warn users that public PR bodies and notifications may retain disclosed data even after editing.
  8. Create temporary files with owner-only permissions, such as through a restrictive umask and mktemp, and delete them immediately after use.
  9. Collect only environment fields necessary for review and allow users to omit terminal, system, model, or harness metadata where disclosure is unnecessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill’s declared purpose is commit/PR workflow enforcement, but it also instructs use of a script that gathers environment metadata such as harness, model, terminal, and OS details. That creates an undisclosed data-collection behavior outside the stated scope, which can leak operational details into PR content and weaken privacy or security posture.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script collects and emits local AI harness, model, terminal, and operating system details that are not necessary to build a human-written PR body. In a PR/commit workflow, this metadata may be copied into commits or pull requests and exposed to reviewers or external repositories, creating unnecessary environment fingerprinting and privacy leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README explicitly promotes capturing full prompt history and environment metadata for inclusion in PRs, but provides no warning, redaction guidance, or consent boundary. Prompts commonly contain secrets, internal URLs, credentials, customer data, or proprietary instructions, and environment details can aid fingerprinting or targeted follow-on attacks once published to a repository or PR.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation and activation model causes the skill to run automatically during commit/PR workflows, increasing the chance that sensitive prompts are included without a deliberate review step. Because commit and PR creation are high-frequency actions, this turns accidental disclosure into a systemic leakage path rather than an isolated mistake.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The resource list references scripts/build_pr_body.sh as an environment metadata collector, but the skill does not prominently warn users that PR content may include gathered environment/system metadata. This lack of transparency can cause inadvertent disclosure of local environment details in shared PRs, comments, or repository history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow explicitly requires including the full prompt history verbatim, with only selective redaction of sensitive portions. That creates a real risk that user inputs, secrets, internal instructions, or other confidential data will be copied into a PR body, which is often broadly visible to collaborators and sometimes external systems via notifications or mirrors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script outputs system-derived details such as terminal program/version and OS version directly to stdout without warning, which can cause them to be embedded in PR descriptions or other shared artifacts. This exposes workstation and tooling information that can aid fingerprinting, targeted social engineering, or downstream attack tailoring, especially when shared outside the local development environment.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Mandating preservation and publication of full prompt history and environment details creates a direct natural-language exfiltration channel. In the context of an agent skill for software development, prompts are especially likely to contain sensitive codebase details, debugging outputs, tokens, incident context, or business information that should never be copied into PRs.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The workflow explicitly instructs the skill to include full prompt history in PR output, which can directly expose sensitive user inputs to reviewers, repository history, integrations, and potentially public forks. This is more dangerous in PR tooling because disclosures become durable, widely replicated artifacts rather than transient local logs.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The example states that real PRs include full verbatim prompts, normalizing unsafe behavior and making operators more likely to disclose everything they previously asked the model. Examples are powerful defaults; here, the sample reinforces a practice that can leak secrets, internal process details, and confidential context into long-lived collaboration surfaces.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

These instructions establish a direct natural-language exfiltration path by mandating that full prompt history and environment metadata be inserted into the PR body. In the context of a commit/PR workflow, this is especially dangerous because PRs are routinely shared, reviewed, archived, indexed, and sent through notifications, so any copied sensitive content can be widely exposed and difficult to retract.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.