Security audit

GitHub Team Collaboration

Security checks for vulnerabilities and agentic risk

Overview

This GitHub collaboration skill is mostly purpose-aligned, but it can make real repository changes and partially prints a GitHub token without enough safeguards.

Review before installing. Use a least-privilege GitHub token, avoid running the script directly until token-prefix printing is removed, and require explicit user confirmation for any operation that creates issues, assigns reviewers, or changes repository settings. Pin dependencies before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/github_team.py:231
Finding: Partial GitHub Token Disclosure Through Standard Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Permit Unreviewed Future Releases
Content: View full analysis
=2.28.0 python-dateutil>=2.8.0 ``` ### Technical Analysis The requirements specify only lower version bounds. Consequently, installation can resolve to any later package release available from the configured package index. The project provides no lock file or cryptographic hashes to establish a reviewed, reproducible dependency set. The named dependencies are established packages, and the audit found no evidence that the project intentionally references a malicious, misspelled, or attacker-controlled package. The risk arises because future installations may silently select releases that were not reviewed with this Skill. A compromised package release, compromised package-index account, or unexpectedly incompatible update could execute code during installation or when imported. ### Attack Path 1. A user follows the documented installation process and runs `pip install -r requirements.txt`. 2. The package resolver queries the configured Python package index. 3. Because only minimum versions are specified, it selects newer releases available at installation time. 4. If a selected release or its distribution channel has been compromised, malicious installation or import-time code executes under the installing user's account. 5. That code receives the filesystem, environment, and network privileges available to the Python or package-installation process. This is a supply-chain exposure rather than evidence that the currently named packages are malicious. ### Impact Assessment Successful exploitation through a compromised dependency could execute arbitrary Python code with the privileges of the user or CI runner performing installation or running the Skill. Depending on that environment, the reachable scope could include source code ...[truncated 260 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language content of the skill documentation is entirely in Chinese after the English title, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents capabilities such as repository management, release management, and webhook configuration, all of which can affect system integrity or project operations. The description does not include any caution that these actions may change repository state, permissions, or automation behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents code that uses environment variables for authentication and GitHub API/network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may invoke capabilities broader than a user expects, increasing the risk of unintended token access or outbound actions against GitHub.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation text is broad enough to match many ordinary software-team requests, which can cause the skill to be selected in situations beyond its narrowly intended use. Because this skill supports repository management, workflow automation, release management, and webhook configuration, over-broad activation increases the chance of invoking networked, potentially write-capable GitHub operations in the wrong context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The assign_reviewers function directly modifies GitHub pull request state by assigning reviewers, but it does so without any confirmation or approval barrier in the function. In an agent-driven workflow, this can cause unauthorized or accidental workflow changes, notification spam, and trust erosion in repository processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The create_issue function performs a state-changing POST request to GitHub without any built-in confirmation, dry-run mode, or explicit user-consent guard. In an agent context, this increases the risk of unintended repository modifications, spam issue creation, or misuse if the function is invoked from loosely validated prompts or automations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The main test block prints the first 10 characters of the GitHub token, which unnecessarily discloses secret material to logs or terminal history. Even partial token exposure can aid credential correlation, token identification, or leakage through shared CI logs, and it is unrelated to the skill’s collaboration functionality.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking releases into the skill's environment.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0 python-dateutil>=2.8.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest references requests without pinning to a reviewed version, and the package has multiple historical advisories. Because the resolved version is not fixed, it is impossible to verify from this file alone whether deployments may include an affected release, which creates avoidable supply-chain exposure.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency is not pinned to an exact version, so installations are not deterministic and may pull in unexpected future releases. This creates supply-chain and stability risk because the deployed package set can vary across environments and over time.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.28.0 python-dateutil>=2.8.0

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The get_github_token function reads the GITHUB_TOKEN environment variable, which is a sensitive credential. Aside from a brief docstring, there is no meaningful safety warning about credential usage, scope, or handling in the skill code.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.