ClawHub
Back to skill

Security audit

PR Auto-Merge Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real PR auto-merge tool, but it can merge code with weaker controls than it promises.

Review before installing. Use only dry-run mode unless you have verified the script yourself, do not rely on `--min-approvals` for policy enforcement, avoid the `pip install gh` workflow example, and run any live merge job with tightly scoped GitHub credentials and server-side branch protection enabled.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auto_merge.py:17
Finding

Configured Minimum Approval Threshold Is Not Enforced

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:85
Finding

CI Example Installs an Unpinned and Potentially Incorrect PyPI Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This is a substantive behavior mismatch, not just a documentation issue: the skill advertises a minimum approval threshold that is reportedly not enforced, so PRs may be merged with fewer approvals than operators expect. It also frames the non-squash path as a merge option while apparently invoking --admin --merge, which uses elevated privileges and can bypass normal branch protection expectations, making autonomous merges significantly more dangerous.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly instructs execution of shell commands (python3, gh, cron/Actions snippets) but does not declare any permissions or allowed-tools scope. That omission weakens safety boundaries because an agent or platform may not have an explicit policy gate for command execution, increasing the chance of unintended repository-modifying actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation promotes autonomous merging and labels dry-run as 'safe' without an equally explicit warning that --no-dry-run performs irreversible repository state changes. In an automation/scheduling context, understated risk messaging can lead users to deploy unattended write actions against production repositories without appreciating the consequences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script advertises and accepts a --min-approvals threshold but never enforces it, relying only on GitHub's coarse reviewDecision == APPROVED state. In an autonomous merge agent, this can merge pull requests with fewer approvals than operators expect, weakening change-control protections and potentially allowing unsafe or malicious code to be merged automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/auto_merge.py (reported line 13)May include surrounding context.

python
cmd = ["gh"] + args
    if repo:
        cmd[2:2] = ["--repo", repo]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result

def get_prs_to_merge(repo, min_approvals=2, dry_run=True):

Static analysis

No suspicious patterns detected.