Security audit

Github Sync Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can upload local files to GitHub and includes under-scoped token handling and destructive remote cleanup behavior that need careful review.

Install only if you are comfortable with a shell-based tool reading local skill files and writing them to GitHub. Use a fine-grained token limited to one private destination repository, avoid passing tokens on the command line, do not run cleanup unless you have reviewed the deletion list, and do not use --skill with anything except a simple verified skill directory name.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sync_to_github.sh:339
Finding: Unrestricted Skill Path Allows Upload of Files Outside the Skills Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync_to_github.sh:48
Finding: Unsafe GitHub Token Handling Exposes Credentials Through Arguments, Output, and Plaintext Configuration
Content: View full analysis
> ~/.zshrc source ~/.zshrc # 3. 密钥管理工具 pass insert github/token ``` ### Technical Analysis The scripts accept GitHub personal access tokens as command-line arguments and the documentation actively demonstrates this usage. Depending on the operating system and shell environment, command-line arguments can be exposed through: - Process-listing utilities - Process inspection interfaces - Shell command history - Terminal session recording - CI/CD command logs - Agent execution traces The documentation also advises users to print the token directly with `echo $GITHUB_TOKEN`, which can disclose it to terminal logs, support transcripts, screen-sharing sessions, or automated audit logs. Persisting the token as plaintext in `~/.zshrc` creates an additional long-lived cre ...[truncated 1365 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/token-troubleshooting.md:34
Finding: Documentation Requests an Overly Broad Classic GitHub Repository Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (51)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token validation and repository permission inspection are not inherently malicious, but they are broader than the core synchronization promise and involve access to sensitive authentication context. When such actions are not clearly disclosed, users may provide tokens without understanding the full scope of access checks being performed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Token validation and repository permission inspection are not inherently malicious, but they are broader than the core synchronization promise and involve access to sensitive authentication context. When such actions are not clearly disclosed, users may provide tokens without understanding the full scope of access checks being performed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Token validation and repository permission inspection are not inherently malicious, but they are broader than the core synchronization promise and involve access to sensitive authentication context. When such actions are not clearly disclosed, users may provide tokens without understanding the full scope of access checks being performed.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/token-troubleshooting.md (reported line 29)May include surrounding context.
错误信息:

text
403 Resource not accessible by personal access token

原因:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/token-troubleshooting.md (reported line 173)May include surrounding context.
md
## 相关资源 - [GitHub Personal Access Tokens 文档](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) - [GitHub API 限流说明](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting) - [OAuth Scopes 参考](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script is designed to recursively delete all remote repository content not present in a hardcoded whitelist, which goes far beyond normal skill synchronization. Because it operates against the repository root and uses authenticated GitHub API DELETE calls, a user running it with a valid token could unintentionally destroy unrelated projects, documentation, or other collaborators' content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The stated purpose is syncing local skills to GitHub, but the implementation includes a repo-wide purge capability that deletes any top-level content not listed in KEEP_SKILLS. That mismatch makes the behavior unexpectedly destructive and especially dangerous in an automation context where users may assume safe incremental sync semantics.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs use of shell commands and local scripts, but it does not declare any tool scope or allowed-tools boundary. This makes the capability less transparent to users and reviewers and increases the chance the agent will execute filesystem and network actions without explicit least-privilege constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description does not prominently warn that synchronization uploads local skill files and metadata to a remote GitHub repository. This omission undermines informed consent and can lead users to expose unpublished code, secrets, or internal metadata unintentionally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrase '备份我的技能' is broad enough to match normal conversational requests that do not necessarily imply uploading local content to GitHub. Overbroad triggering can cause the skill to activate in contexts where the user did not intend remote publication, increasing the chance of accidental data exposure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill transmits authentication data and account-related requests to the GitHub API, which is expected for its purpose but still represents external transmission of sensitive context. If a user does not fully understand that their token and local skill metadata are being used against remote endpoints, this creates a real risk of credential misuse or unintended disclosure.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
bash
# 验证 Token 所有者 curl -s -H "Authorization: token $GITHUB_TOKEN" \ https://api.github.com/user | jq -r '.login' # 验证仓库权限 curl -s -H "Authorization: token $GITHUB_TOKEN" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: Checking repository permissions via the GitHub API is legitimate for sync functionality, but it still sends token-authenticated requests to a remote service and reveals repository targeting information. In the context of a skill that may auto-trigger on broad backup language, this becomes more dangerous because users may not realize a remote repo is being queried or prepared for writes.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
验证仓库权限

curl -s -H "Authorization: token $GITHUB_TOKEN"
https://api.github.com/repos// | jq '.permissions'

text
## 输出格式

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
bash
# 你创建了 new-skill 目录 mkdir -p ~/.claude/skills/new-skill # ... 编辑 SKILL.md 和脚本 ... # 同步到 GitHub

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
bash
# 你创建了 new-skill 目录 mkdir -p ~/.claude/skills/new-skill # ... 编辑 SKILL.md 和脚本 ... # 同步到 GitHub

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
bash
# 你创建了 new-skill 目录 mkdir -p ~/.claude/skills/new-skill # ... 编辑 SKILL.md 和脚本 ... # 同步到 GitHub

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package description is entirely in Chinese, indicating a language-specific skill presentation with no accompanying option for users to choose another language or confirmation that the skill is intended only for a Chinese-language audience. This matches the policy category for language or locale constraints imposed without user opt-in.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/token-troubleshooting.md (reported line 82)May include surrounding context.
md
2. 手动创建仓库： - 访问 https://github.com/new - 输入仓库名称 - 点击 Create repository 3. 或使用 API 创建（需要 Token 有 repo 权限） ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/token-troubleshooting.md (reported line 82)May include surrounding context.
md
2. 手动创建仓库: - 访问 https://github.com/new - 输入仓库名称 - 点击 Create repository 3. 或使用 API 创建(需要 Token 有 repo 权限) ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document recommends persisting a GitHub personal access token in a shell startup file such as ~/.zshrc without warning that this stores the secret in plaintext on disk. That increases the chance of credential theft via local compromise, backups, screen sharing, dotfile sync, or accidental publication.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This shell script presents its title, usage notes, status messages, and remediation guidance in Chinese-only text, which imposes a specific language on users. The file does not offer a language choice, fallback, or justification that it is intended only for a Chinese-language or region-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language strings throughout the file, including comments, usage text, error messages, and confirmation prompts, are Chinese-only. Per the policy, forcing a specific language without opt-in or documented locale-specific justification is a language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This outbound request is not merely network communication; it performs authenticated DELETE operations against the GitHub API using the supplied token. In context, the call is part of a recursive purge workflow, so the external transmission directly causes remote destructive state changes rather than benign syncing.
Content: Scanner excerpt · scripts/cleanup_remote_repo.sh (reported line 74)May include surrounding context.
sh
log_info " [DRY-RUN] 删除：$item_path" else log_info " 删除：$item_path" curl -s -X DELETE -H "Authorization: token $TOKEN" \ "https://api.github.com/repos/$OWNER/$REPO/contents/$item_path" \ -d "{\"message\":\"Cleanup\",\"sha\":\"$sha\",\"branch\":\"main\"}" > /dev/null fi

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script's comments, usage text, prompts, and status messages are written in Chinese, including the help output and confirmation prompt. That imposes a specific language on users without any opt-in or alternative locale, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_to_github.sh (reported line 160)May include surrounding context.
sh
create_repo() { log_info "创建仓库 $OWNER/$REPO..." response=$(curl -s -X POST \ -H "Authorization: token $TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ https://api.github.com/user/repos \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_to_github.sh (reported line 322)May include surrounding context.
sh
# 更新 README if [ -n "$readme_sha" ] && [ "$readme_sha" != "null" ]; then # 已存在，更新 curl -s -X PUT -H "Authorization: token $TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$OWNER/$REPO/contents/README.md" \ -d "{\"message\":\"Update README with new skills: $synced_skills\",\"content\":\"$encoded\",\"sha\":\"$readme_sha\",\"branch\":\"main\"}" > /dev/null

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tp4

Tp4

Tp4

Credential Access

Credential Access

Description-Behavior Mismatch

Context-Inappropriate Capability

Undeclared Tool Scope

Missing User Warnings

Vague Triggers

External Transmission

External Transmission

验证仓库权限

Skill Enumeration

Session Persistence

Session Persistence

Natural-Language Policy Violations

Session Persistence

Session Persistence

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

Natural-Language Policy Violations

External Transmission

External Transmission

Static analysis