Github Sync Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 8:39 AM UTC
• Version: 2.0.0

Overview

This GitHub sync skill is mostly coherent, but it includes under-disclosed remote deletion and broad upload behavior that users should review carefully.

Install only if you are comfortable granting a GitHub token that can write to the target repository. Use a fine-grained token limited to one repository, review the files under each skill before syncing, avoid broad or persistent token storage, and do not run cleanup_remote_repo.sh unless you have reviewed a dry run and intend to delete every unlisted remote item.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises shell-based workflows and executable scripts but does not declare any permissions, which undermines user awareness and consent around command execution. In an agent setting, hidden shell capability increases the risk of unintended local file operations, token handling, or repository modification without clear security boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is GitHub synchronization, but the broader behavior includes remote cleanup/deletion, repository creation, local repo inspection, and token permission verification. This mismatch is dangerous because users may consent to 'sync' while the skill performs destructive or higher-privilege operations they did not reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script is not merely synchronizing local skills to GitHub; it enumerates the entire repository and recursively deletes all top-level entries not present in a hardcoded allowlist. In the context of a 'github-sync-skill', this creates a destructive repository-wide purge capability that can remove unrelated content if run with a valid token, making accidental or abusive data loss highly likely.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: A hardcoded repository-wide purge mechanism is not justified by the stated use case of syncing skills, and it operates against fixed OWNER/REPO values. This mismatch between declared purpose and actual behavior increases the chance that users grant trust or credentials for synchronization while unknowingly enabling mass deletion of remote repository contents.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrase '备份我的技能' is broad and can match ordinary backup requests that do not imply GitHub publication or remote transmission. In practice this can cause the agent to invoke a networked, state-changing skill in response to ambiguous user intent, leading to unintended upload of local content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly recommends persisting a GitHub personal access token in a shell startup file, which increases the chance of long-term local credential exposure through misconfigured file permissions, backups, shell history-adjacent leakage, or accidental dotfile sync to a repository. While this is common convenience advice, it is unsafe without strong warnings and safer alternatives because the token grants repository access.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 验证 Token 所有者
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/user | jq -r '.login'

# 验证仓库权限
curl -s -H "Authorization: token $GITHUB_TOKEN" \

• Confidence: 88% confidence
• Finding: The skill transmits authentication material and repository-related metadata to the GitHub API, which is expected for its purpose but still constitutes external data transmission. This is security-relevant because ambiguous activation, overbroad scope, or logging mistakes could expose tokens or cause unintended disclosure of repository/account information.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 验证仓库权限
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/repos/<owner>/<repo> | jq '.permissions'
```

## 输出格式

• Confidence: 88% confidence
• Finding: Calling the repository permissions endpoint sends authenticated requests to an external service and reveals account-to-repo access relationships. While consistent with the skill's function, this still creates privacy and misuse risk if done automatically or without clear disclosure and user intent confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 创建/更新文件
    if [ -n "$sha" ]; then
        result=$(curl -s -X PUT -H "Authorization: token $TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$OWNER/$REPO/contents/$path" \
            -d "{\"message\":\"$message\",\"content\":\"$encoded\",\"sha\":\"$sha\",\"branch\":\"main\"}")

• Confidence: 86% confidence
• Finding: This function uploads every file found under a selected skill directory to GitHub without filtering sensitive files, symlinks, or hidden metadata. If a skill directory accidentally contains secrets, tokens, private notes, or linked files outside the skill tree, the script may publish them to the remote repository.

External Transmission

Medium

• Category: Data Exfiltration

Content

if [ -n "$sha" ]; then
        result=$(curl -s -X PUT -H "Authorization: token $TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$OWNER/$REPO/contents/$path" \
            -d "{\"message\":\"$message\",\"content\":\"$encoded\",\"sha\":\"$sha\",\"branch\":\"main\"}")
    else
        result=$(curl -s -X PUT -H "Authorization: token $TOKEN" \

• Confidence: 86% confidence
• Finding: This code updates arbitrary repository paths derived from local files and sends full file contents to GitHub without enforcing path constraints or validating that the content is safe to publish. In a skill ecosystem where directories may contain generated files, secrets, or symlinks, this increases the risk of unintended disclosure or repository poisoning.

External Transmission

Medium

• Category: Data Exfiltration

Content

else
        result=$(curl -s -X PUT -H "Authorization: token $TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$OWNER/$REPO/contents/$path" \
            -d "{\"message\":\"$message\",\"content\":\"$encoded\",\"branch\":\"main\"}")
    fi

• Confidence: 86% confidence
• Finding: Creating new remote files from arbitrary local files without content or path filtering can expose sensitive local material if it is present inside the synced directory. Because the script walks the tree automatically, a user may publish unintended files to a public repository without realizing it.

Static analysis

No suspicious patterns detected.