ClawHub
Back to skill

Security audit

Launchthatbot Git Team Ops

Security checks for vulnerabilities and agentic risk

Overview

The skill’s GitOps purpose is clear, but installing it deserves review because it handles powerful GitHub credentials and repository write workflows with some important boundaries left undefined.

Review the authentication flow before installation. Prefer managed short-lived GitHub App tokens, avoid pasting private keys or PATs into chat unless you understand where they go, pin the installer version in controlled environments, and reduce the release workflow permissions until real release steps require them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
README.md:37
Finding

Mutable Package Installer Is Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation
install launchthatbot-git-team-ops ``` 2. Pin the installed Skill version as well if the package manager supports that capability. 3. Document package-integrity verification using registry integrity metadata, checksums, or signed release artifacts. 4. Review the exact installer version before updating the documented command. 5. For security-sensitive deployments, obtain the installer from an organization-controlled registry or verified release artifact rather than relying on a mutable distribution tag. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
templates/github/workflows/senior-release-control.yml:15
Finding

Placeholder Release Workflow Receives Unnecessary Repository Write Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:69
Finding

Sensitive GitHub App Credentials Have an Undefined Transport and Trust Boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
- Installation ID
- App private key (PEM)

Use only installation access tokens for repo operations.
Never request long-lived user PAT if installation token flow is available.

### pat mode

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The install command uses npx clawhub@latest, which fetches and executes the latest published package version at runtime instead of a pinned, reviewed release. In a security-sensitive GitOps skill that can influence repository workflows and agent behavior, this increases supply-chain risk because a compromised or malicious upstream release could be executed by users during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.