Software Data Github Interact Developer Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only developer workflow helper; its routing is overly broad, but I found no executable payload, credential handling, persistence, or hidden destructive behavior.

Installers should know this skill may activate for fairly broad GitHub, CLI, issue, run, or API wording. Review agent actions before allowing repository changes or external GitHub operations, but the packaged skill itself does not contain executable code or credential-handling behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger sentences are broad, repetitive, and map to common software/help phrasing, which can cause accidental or inappropriate skill activation outside the author's intended scope. In an agent environment, overbroad activation increases the chance that this skill handles requests involving repositories, issues, or CLI workflows without sufficient user intent verification, potentially leading to unsafe or irrelevant actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md

- hacker-news-ask-hn：[Ask HN: Is our data warehouse setup normal or over-complicated?](https://news.ycombinator.com/item?id=48556530)
- hacker-news-ask-hn：[Ask HN: Claude renamed my VM from the inside?](https://news.ycombinator.com/item?id=48551386)
- hacker-news-ask-hn：[Ask HN: Active GitHub accounts (probably) delivering malware, now what?](https://news.ycombinator.com/item?id=48548530)
- hacker-news-ask-hn：[Ask HN: Why aren't hardware passkeys used for access token creation?](https://news.ycombinator.com/item?id=48555543)
- hacker-news-ask-hn：[Ten Years of Just (and Lists)](https://news.ycombinator.com/item?id=48562408)
- github-issues：[Guided arqctl connect --auto: detect → mint → test → role-safety → print missing grant (#92)](https://github.com/Elevarq/Arq-Signals/issues/99)
- github-issues：[Add issue-template config.yml (disable blank issues + contact links)](https://github.com/DataDave-Dev/weftmap/issues/70)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 24)May include surrounding context.

md

- hacker-news-ask-hn：[Ask HN: Is our data warehouse setup normal or over-complicated?](https://news.ycombinator.com/item?id=48556530)
- hacker-news-ask-hn：[Ask HN: Claude renamed my VM from the inside?](https://news.ycombinator.com/item?id=48551386)
- hacker-news-ask-hn：[Ask HN: Active GitHub accounts (probably) delivering malware, now what?](https://news.ycombinator.com/item?id=48548530)
- hacker-news-ask-hn：[Ask HN: Why aren't hardware passkeys used for access token creation?](https://news.ycombinator.com/item?id=48555543)
- hacker-news-ask-hn：[Ten Years of Just (and Lists)](https://news.ycombinator.com/item?id=48562408)
- github-issues：[Guided arqctl connect --auto: detect → mint → test → role-safety → print missing grant (#92)](https://github.com/Elevarq/Arq-Signals/issues/99)
- github-issues：[Add issue-template config.yml (disable blank issues + contact links)](https://github.com/DataDave-Dev/weftmap/issues/70)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are so generic that they can match ordinary software or GitHub-related requests and cause this skill to activate outside its intended scope. In an agent ecosystem, over-broad routing can lead to unintended execution paths, user confusion, and increased exposure to downstream risky actions such as repository, issue, or CLI workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description is framed so broadly that it can match many ordinary software requests, causing the agent to invoke this skill outside its intended scope. Over-broad routing increases the chance of prompt collisions, inappropriate tool/workflow selection, and accidental exposure of unrelated user tasks to a skill not specifically designed for them.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger keywords include highly generic terms like 'run', 'api', 'issue', and 'github' without contextual constraints, making accidental activation very likely. In agent systems, ambiguous triggers can lead to skill hijacking, where this skill captures requests intended for safer or more specialized skills, degrading security and reliability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/requirement-plan.md (reported line 43)May include surrounding context.

md

- hacker-news-ask-hn (2026-06-16T15:12:46+00:00): [Ask HN: Is our data warehouse setup normal or over-complicated?](https://news.ycombinator.com/item?id=48556530)
- hacker-news-ask-hn (2026-06-16T06:34:29+00:00): [Ask HN: Claude renamed my VM from the inside?](https://news.ycombinator.com/item?id=48551386)
- hacker-news-ask-hn (2026-06-15T23:30:18+00:00): [Ask HN: Active GitHub accounts (probably) delivering malware, now what?](https://news.ycombinator.com/item?id=48548530)
- hacker-news-ask-hn (2026-06-16T14:06:30+00:00): [Ask HN: Why aren't hardware passkeys used for access token creation?](https://news.ycombinator.com/item?id=48555543)
- hacker-news-ask-hn (2026-06-16T21:29:11+00:00): [Ten Years of Just (and Lists)](https://news.ycombinator.com/item?id=48562408)
- github-issues (2026-06-16T23:49:12+00:00): [Guided arqctl connect --auto: detect → mint → test → role-safety → print missing grant (#92)](https://github.com/Elevarq/Arq-Signals/issues/99)
- github-issues (2026-06-16T23:46:20+00:00): [Add issue-template config.yml (disable blank issues + contact links)](https://github.com/DataDave-Dev/weftmap/issues/70)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are overly broad and generic, making the skill eligible to activate for many ordinary requests that only loosely relate to the intended GitHub-style workflow use case. In an agent environment, this can cause unintended invocation, scope creep, and routing of unrelated user tasks into a skill that may take actions or provide guidance outside the user's actual intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file descriptions prescribe SKILL.md and README.md as English and their counterparts as Chinese, but do not state that language selection is optional or user-driven. This can be read as enforcing a fixed language/locale setup without opt-in, which may conflict with language choice policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example trigger phrases are themselves broad and circular, showing invocation patterns that do not define meaningful boundaries for when the skill should or should not run. This reinforces overmatching behavior and makes operator review harder because examples normalize generic activation rather than precise routing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description defines a very broad operating scope covering bug fixing, hardening, reliability, adjacent skills, workflows, artifacts, checklists, analysis, and implementation support. Without clearer boundaries, the orchestrator may invoke this skill for many loosely related requests, increasing the chance of misrouting and causing the skill to handle tasks it was not specifically designed or reviewed for.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords include very generic terms such as "run", "api", "issues", and "github", which can match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate routing, irrelevant assistance, or accidental exposure of capability in contexts where a narrower skill should respond.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation without any visible trigger constraints, narrowing conditions, or user-consent guardrails. In a broadly scoped GitHub/developer-helper skill, this increases the chance the agent will auto-select the skill in situations involving repositories, issues, CLI workflows, or code changes, potentially causing unintended actions or overexposure of project context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This file is locale-specific and references separate English and Chinese variants, but it does not explicitly state that users can choose their preferred language for interaction. Because policy violations here are limited to forced language or locale constraints, this is only a mild concern rather than a strong violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L48-L50 的示例触发句全部使用英文，即使该文件整体为中文说明，也未说明用户可使用中文或其他语言等价触发。根据规则，若技能在自然语言说明中隐含要求特定语言而未提供选择，可能构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.