Security audit

Software Data Github Interact Developer Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a broad GitHub/developer workflow helper with loose triggers, but it does not contain hidden execution, persistence, credential use, or destructive behavior.

Install only if you want a general-purpose GitHub/developer workflow helper. Be aware it may activate more often than expected because its triggers are broad; review the agent's proposed actions before allowing repository changes, API calls, issue or PR activity, or command execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example phrases are so generic that this skill can activate for ordinary software-help requests far beyond its intended scope. Over-broad activation increases the chance the agent selects this skill inappropriately, causing prompt-space interference, priority hijacking, or unsafe workflow substitution when a more specific and better-scoped skill should have handled the request.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is so broad and generic that it can match routine user language unrelated to the intended GitHub-style workflow domain. This increases the chance of accidental skill activation, causing the agent to apply the wrong capability or expose repository-oriented instructions in contexts where they were not requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are so generic that they can cause the skill to activate for loosely related requests, increasing the chance of unintended invocation and over-broad delegation. In an agent ecosystem, this can route ordinary user prompts into a GitHub-interaction workflow that may encourage issue/PR/API actions without sufficiently clear user intent or scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation section lists natural-language trigger phrases such as "Help me" and "I need a practical workflow," which overlap heavily with ordinary user requests and do not clearly define when this skill should or should not activate. The README also provides no negative examples or narrow contextual constraints to limit invocation scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords include very common terms such as "run", "api", "issues", and "github", which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance that this skill intercepts prompts unexpectedly, potentially steering workflows, overriding more appropriate skills, or causing unintended actions in sensitive developer contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example trigger phrases are written as broad natural-language requests that could match ordinary user messages without an explicit invocation boundary. This makes accidental activation more likely, especially because the examples mirror common help-seeking language rather than constrained command forms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt and description are extremely broad, covering generic developer-help tasks like fixing bugs, hardening safety, improving reliability, and creating adjacent skills. This creates an overly permissive invocation surface that can match ordinary user requests and cause the skill to activate in contexts the user did not explicitly intend, increasing the risk of prompt hijacking, unwanted tool use, or privilege boundary confusion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Enabling implicit invocation without tight trigger constraints allows the skill to be auto-selected for broad classes of normal developer queries. In a skill positioned around GitHub-style workflows and implementation support, this can lead to accidental activation on sensitive coding or repository-related tasks, where the skill may influence outputs or workflows without clear user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description and trigger scope are underspecified, so the skill may be selected for many software-adjacent requests that do not actually need this capability. In an agent system, overly permissive routing can lead to confused-deputy behavior, misapplied actions, or unnecessary exposure of workflow guidance in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: Although this file is labeled as a Chinese README, multiple key user-facing sections and trigger phrases are written in English, with no statement about language preference or opt-in. This can amount to forcing a language/locale experience without clearly giving the user a choice or explaining the constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.