Security audit

GitHub-Assistant-Skill

Security checks for vulnerabilities and agentic risk

Overview

This GitHub helper matches its stated purpose, but it asks for very broad GitHub access and handles tokens, browser sessions, and installation in ways that need careful review.

Review before installing. Use a fine-grained, short-lived GitHub token limited to selected repositories and only the permissions needed for the task; avoid classic PATs and all-repository access. Treat ~/.github-assistant as sensitive, avoid passing tokens on the command line, do not use browser login on untrusted networks, and avoid the hosts-file, --ipc=host, and third-party mirror installer paths unless you explicitly accept those risks.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config.py:69
Finding: GitHub Tokens and Browser Sessions Are Persisted Without Explicit Access Controls
Content: View full analysis
") sys.exit(1) result = token_login(sys.argv[2]) ``` ### Technical Analysis The Skill writes reusable GitHub Personal Access Tokens directly to `~/.github-assistant/github_token.txt` and saves browser cookies and localStorage to `github_auth.json`. Neither the directory nor the credential files are created with explicit restrictive permissions. The effective permissions therefore depend on the user's current `umask`. In an environment with permissive defaults, other local users or processes may be able to read the token or authenticated browser state. The documented login method also accepts the PAT as a command-line argument. Command-line arguments may be exposed through: - Shell history - Process inspection tools - Process accounting or monitoring agents - Terminal logging - CI/CD command logs This conflicts with the ...[truncated 1087 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/github_login.py:76
Finding: TLS Certificate Validation Is Disabled During GitHub Login and Authenticated Browsing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/github_browser_ops.py:169
Finding: Arbitrary URLs Can Be Opened in a Browser Context Restored With GitHub Authentication State
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install_browser.py:290
Finding: Installer Automatically Retrieves Executable Dependencies From Unverified Third-Party Mirrors
Content: View full analysis
= required_build: mirror_url, _ = MIRROR_SOURCES[best_mirror] print(f"\n🌐 使用国内镜像源: {best_mirror}") print("💡 国内镜像源下载速度更快") success, _ = run_install_with_mirror(mirror_url) ``` The dependency file uses open-ended ranges: ```text requests>=2.28.0 playwright>=1.40.0 ``` ### Techn ...[truncated 2082 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:126
Finding: Onboarding Recommends Excessive GitHub Permissions Across All Repositories
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:155
Finding: Documentation Recommends a Persistent Privileged DNS Override for an Executable Download Host
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (112)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented goto command allows navigation to an arbitrary URL, which is unjustified for a GitHub-focused assistant and effectively turns the skill into a general browser with an authenticated session. This can enable phishing, token/session theft, or unintended interaction with untrusted sites if invoked by a user or chained workflow.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: The README presents a piped command that writes directly into /etc/hosts via sudo tee -a, combining unreviewed output with privileged file modification. Even though the string is hardcoded here, this pattern is dangerous in agent and copy-paste contexts because it habituates users to chained root commands and reduces the chance they will inspect privileged changes carefully.
Content: Scanner excerpt · README.md (reported line 174)May include surrounding context.
nslookup cdn.playwright.dev 8.8.8.8

添加到 hosts 文件（需要管理员权限）

echo "13.107.253.39 cdn.playwright.dev" | sudo tee -a /etc/hosts

text
**Windows (PowerShell 管理员):**

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The Docker example uses --ipc=host, which shares the host IPC namespace with the container. This weakens isolation and can expose or interfere with host/container processes, making the example more dangerous than necessary for a skill installation guide, especially in multi-tenant or agent-hosted environments.
Content: Scanner excerpt · README.md (reported line 300)May include surrounding context.
Mac/Linux:

bash
docker run -it --rm \ --ipc=host \ -v "$(pwd):/workspace" \ -w /workspace \ mcr.microsoft.com/playwright/python:v1.40.0-jammy \

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The PowerShell Docker example repeats the host IPC sharing pattern, creating the same container-isolation risk on Windows environments using Linux containers. In documentation for an AI-agent skill, normalizing weakened isolation increases the chance operators will copy unsafe defaults into production-like environments.
Content: Scanner excerpt · README.md (reported line 310)May include surrounding context.
Windows (PowerShell):

powershell
docker run -it --rm ` --ipc=host ` -v "${PWD}:/workspace" ` -w /workspace ` mcr.microsoft.com/playwright/python:v1.40.0-jammy `

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The CMD Docker command also uses --ipc=host, so the same reduced-isolation concern applies. Because the skill handles authenticated GitHub sessions and can browse the web, running it in a less isolated container context raises the blast radius if the browser or container is compromised.
Content: Scanner excerpt · README.md (reported line 319)May include surrounding context.
Windows (CMD):

cmd
docker run -it --rm --ipc=host -v "%CD%:/workspace" -w /workspace mcr.microsoft.com/playwright/python:v1.40.0-jammy bash -c "pip install -r scripts/requirements.txt && python3 scripts/github_trending.py daily"

Docker方案优势：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 372)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens?type=beta - 或 GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. **生成新 Token** - 点击 "Generate new token"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 421)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens?type=beta - 或 GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. **生成新 Token** - 点击 "Generate new token"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 855)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens?type=beta - 或 GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. **生成新 Token** - 点击 "Generate new token"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 904)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens?type=beta - 或 GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. **生成新 Token** - 点击 "Generate new token"

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A generic goto capability is overbroad for a GitHub assistant and can be abused to direct the automated browser to attacker-controlled sites. In the context of a logged-in browser session, this raises phishing, session abuse, exfiltration, and prompt-chaining risks because the skill can be induced to interact with arbitrary content beyond GitHub.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill also performs local package installation, browser binary installation, network/proxy checks, and download-source selection, none of which are reflected in the top-level purpose. These host-modifying behaviors increase supply-chain and environment-risk exposure because the skill can alter the local system and pull executable dependencies from external mirrors.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill explicitly instructs users to generate and provide GitHub Personal Access Tokens with broad read/write repository permissions and potentially all-repository scope. Collecting high-privilege credentials inside a general-purpose skill is dangerous because compromise, mishandling, or overuse of the stored token could lead to repository takeover, code modification, workflow abuse, and access to private data across many repos.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
--- **选项 1：Fine-grained Personal Access Token（推荐）** 更安全的权限控制，可为每个仓库单独配置权限。

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The instructions direct the user to GitHub access-token creation flows and encourage broad permission assignment for operational convenience. This elevates risk because the skill is normalizing acquisition of sensitive credentials that can grant extensive control over code, issues, PRs, releases, and security-related repository data.
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens?type=beta - 或 GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens 2. **生成新 Token** - 点击 "Generate new token"

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The classic PAT path requests a legacy credential type that is broader and harder to constrain than fine-grained tokens. Supporting and documenting classic PAT collection increases the likelihood of excessive privileges and long-lived credentials being stored locally, magnifying the impact of theft or accidental leakage.
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
--- **选项 2：Classic Personal Access Token** 传统的 Token 类型，使用 scopes 权限模型。

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: Directing users into classic access-token creation with broad scopes like repo/public_repo creates a high-value secret exposure path. In this skill's context, the token can be used not just for read access but for mutating repositories, issues, PRs, files, and workflows, so any misuse or compromise has organization-level consequences.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
1. **打开设置页面** - 访问 https://github.com/settings/tokens - 或 GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic) 2. **生成新 Token** - 点击 "Generate new token (classic)"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/github_api_endpoints.md (reported line 25)May include surrounding context.
md
## Star Operations - Star: `PUT /user/starred/{owner}/{repo}` (no body) - Unstar: `DELETE /user/starred/{owner}/{repo}` - List starred: `GET /user/starred` - Check if starred: `GET /user/starred/{owner}/{repo}` (204 = starred, 404 = not starred)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/github_api_endpoints.md (reported line 35)May include surrounding context.
md
## Watch (Subscription) - Watch: `PUT /repos/{owner}/{repo}/subscription` body: `{"subscribed": true}` - Unwatch: `DELETE /repos/{owner}/{repo}/subscription` - Check: `GET /repos/{owner}/{repo}/subscription` ## Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/github_api_endpoints.md (reported line 46)May include surrounding context.
md
- Close issue: `PATCH /repos/{owner}/{repo}/issues/{issue_number}` body: `{"state": "closed"}` - Reopen issue: `PATCH /repos/{owner}/{repo}/issues/{issue_number}` body: `{"state": "open"}` - Lock issue: `PUT /repos/{owner}/{repo}/issues/{issue_number}/lock` body: `{"lock_reason": "off-topic|too heated|resolved|spam"}` - Unlock issue: `DELETE /repos/{owner}/{repo}/issues/{issue_number}/lock` ## Issue Labels - List labels: `GET /repos/{owner}/{repo}/labels`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/github_api_endpoints.md (reported line 51)May include surrounding context.
md
## Issue Labels - List labels: `GET /repos/{owner}/{repo}/labels` - Add labels: `POST /repos/{owner}/{repo}/issues/{issue_number}/labels` body: `{"labels": ["bug", "help wanted"]}` - Remove label: `DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` - Set labels (replace all): `PUT /repos/{owner}/{repo}/issues/{issue_number}/labels` body: `{"labels": ["bug"]}` ## Issue Comments

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/github_api_endpoints.md (reported line 58)May include surrounding context.
md
- List comments: `GET /repos/{owner}/{repo}/issues/{issue_number}/comments` - Create comment: `POST /repos/{owner}/{repo}/issues/{issue_number}/comments` body: `{"body": "..."}` - Update comment: `PATCH /repos/{owner}/{repo}/issues/comments/{comment_id}` body: `{"body": "..."}` - Delete comment: `DELETE /repos/{owner}/{repo}/issues/comments/{comment_id}` ## Pull Requests - List PRs: `GET /repos/{owner}/{repo}/pulls?state=open&per_page=100`

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Context-Inappropriate Capability

Chaining Abuse

添加到 hosts 文件（需要管理员权限）

Privileged Container / Container Escape

Privileged Container / Container Escape

Privileged Container / Container Escape

Credential Access

Credential Access

Credential Access

Credential Access

Context-Inappropriate Capability

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Static analysis