Security audit

OSS Contributor

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent open-source contribution purpose, but it can publish code and PRs under the user's GitHub identity while handling credentials unsafely and bypassing review in automated modes.

Install only if you are comfortable giving this skill a narrowly scoped, revocable GitHub token and allowing it to create forks, commits, pushes, and public pull requests. Avoid --auto, --yes, heartbeat, or cron use unless you first review the exact PR body and fix the credential handling issues, especially token reads from ~/.openclaw/openclaw.json, token-prefix logging, and token-in-URL cloning.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:303
Finding: Mandatory Branded Content Injection into Published Pull Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:263
Finding: GitHub Token Prefix Disclosed to Agent Output and Logs
Content: View full analysis
/dev/null | jq -r '.skills.entries["gh-issues"].apiKey // empty') Verify: echo "Token: ${GH_TOKEN:0:10}..." ``` ### Technical Analysis The Skill reads an API key from another Skill's OpenClaw configuration and prints the first ten characters of that credential. Printing any part of an authentication token is unnecessary to verify that the token exists. Because this command is intended for execution by a sub-agent, the disclosed prefix may be retained in agent transcripts, terminal recordings, CI output, debugging logs, or task reports. A token prefix can identify or correlate a credential and reduces its effective secrecy. The behavior also exceeds least privilege: the Skill metadata declares `GH_TOKEN` as its primary environment variable, so reading the `gh-issues` Skill's stored API key directly is unnecessary when the declared variable is already available. ### Attack Path 1. The sub-agent reads `~/.openclaw/openclaw.json`. 2. It extracts `.skills.entries["gh-issues"].apiKey`. 3. The value is exported as `GH_TOKEN`. 4. The first ten token characters are printed to standard output. 5. The output is captured in an agent transcript, shell log, CI log, or monitoring system. 6. A party with access to those records obtains sensitive token material and can correlate it with other leaks or credential records. ### Impact Assessment This finding directly exposes part of a GitHub authentication credential. It does not, by itself, reveal the complete token, so direct account takeover from this snippet alone is not established. The affected scope includes any execution logs or transcripts produced by the parent agent or spawned sub-agent. If combined with another disclosure, the leaked prefix can assist credential identification a ...[truncated 115 chars]
Remediation: View remediation
&2 exit 1 fi ``` 4. If authentication must be tested, call a low-impact GitHub endpoint and inspect only the HTTP status. 5. Redact authorization headers and credentials from agent transcripts, command traces, and diagnostic output. 6. Use a narrowly scoped, revocable GitHub token with only the repository permissions required by the workflow. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:269
Finding: GitHub Token Embedded in Git Clone Command URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The sub-agent reads a credential from a local secrets file and then prints part of the token to output for verification. Even partial credential disclosure increases the attack surface through logs, transcripts, or monitoring systems, and reading from a local secrets file bypasses the declared secret-management boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that GH_TOKEN is already available in the environment, but later instructs the sub-agent to reload it from a local config file. This contradiction weakens operator understanding, undermines secret provenance, and increases the chance of unsafe credential handling or cross-skill secret reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill makes repeated authenticated network requests and git operations using GH_TOKEN, but lacks a prominent disclosure that the token will be used for API calls and HTTPS git authentication. Users may not understand that invoking the skill causes authenticated external operations against GitHub.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The --auto mode explicitly removes confirmation prompts and enables headless operation for a workflow that can perform public code contributions and account-linked actions. In a high-impact skill like this, autonomous execution materially increases the chance of unwanted or reputationally damaging actions without immediate human review.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
| --languages | _(from config)_ | Filter repos by primary language | | --max-complexity | medium | Skip issues above this: low, medium, high | | --dry-run | false | Discover + triage only, no PRs | | --auto | false | Headless mode for heartbeat/cron (no confirmation prompts) | | --discover | false | Find trending repos matching your topics (in addition to configured repos) | | --model | _(agent default)_ | Model for fix sub-agents | | --notify-channel | _(none)_ | Telegram channel for PR notifications |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill supports headless modes that can automatically fork repositories, push commits, and open public pull requests, but the description and flag documentation do not prominently warn users about these externally visible side effects. This creates a consent and safety problem because users may invoke automation without realizing it performs public actions on their behalf.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The --yes flag skips confirmation and processes all eligible issues, allowing the skill to batch public actions without per-issue approval. Given the ability to fork repos, commit code, push, and open PRs, this creates a meaningful risk of unintended external operations.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
| --discover | false | Find trending repos matching your topics (in addition to configured repos) | | --model | _(agent default)_ | Model for fix sub-agents | | --notify-channel | _(none)_ | Telegram channel for PR notifications | | --yes | false | Skip confirmation, process all eligible issues | Load config from workspace:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
Resolve GitHub username:

bash
curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user | jq -r '.login'

Store as GH_USER.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: Marking certain issues as 'auto-approve' allows the agent to make implementation decisions and public contributions based on simplistic heuristics like labels and body length. Those heuristics can be wrong, causing the agent to act on unsuitable issues or make low-quality public changes under the user's identity.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
For each candidate issue, estimate complexity: **Low complexity** (auto-approve): - Labels: `documentation`, `typo`, `good-first-issue`, `test` - Issue body < 500 chars - Single file referenced

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The sub-agent is instructed to ignore the declared environment-provided credential source and instead read a token from an unrelated local secrets file. This expands credential exposure across skill boundaries and can cause the agent to use the wrong secret, including one with broader privileges than intended.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
Fallback body (ONLY if no PR template exists): "## Summary\n\n{description}\n\n## Changes\n\n{bullet_list}\n\n## Testing\n\n{test_results}\n\nFixes #{number}" curl -s -X POST \ -H "Authorization: Bearer $GH_TOKEN" \ -H "Accept: application/vnd.github+json" \ https://api.github.com/repos/{SOURCE_REPO}/pulls \

Static analysis

No suspicious patterns detected.