ForkZoo

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

ForkZoo appears purpose-aligned, but it needs review because adopting a pet automatically grants and uses powerful GitHub repository and workflow authority.

Install only if you are comfortable giving the skill GitHub repository and workflow authority. Review the upstream ForkZoo repositories and workflow files first, use the narrowest token possible, and expect adoption to create a fork, enable GitHub Actions, trigger workflows, and publish a GitHub Pages site.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to run local shell scripts (`./scripts/adopt.sh`, `status.sh`, `interact.sh`, `history.sh`) and to use a GitHub token with `repo` and `workflow` scopes, but the manifest does not declare corresponding permissions. This mismatch is dangerous because it obscures the skill's real capability footprint, increasing the chance that an agent executes code or uses sensitive credentials without explicit user awareness or platform-level gating.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script explicitly enables GitHub Actions on the newly forked repository and sets `allowed_actions` to `all`, which grants the fork the ability to run arbitrary marketplace and external actions. For a pet-adoption workflow, this is far broader than necessary and creates a supply-chain execution risk if the source repository or any referenced workflows/actions are malicious or later compromised.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Configuring the adopted repository with `allowed_actions: all` gives the fork unjustified execution capability unrelated to simply creating a pet repository. In context, the script also immediately dispatches a workflow, so this broad permission can lead to automatic execution of untrusted workflow code under the user's GitHub account and repository context.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description includes broad activation language such as pet-related requests, tamagotchi mentions, forkzoo references, and generic 'my pet' queries, which can cause the skill to trigger in contexts where the user did not intend to invoke GitHub-backed automation. In this skill's context, over-broad triggering is more dangerous because invocation may lead to shell execution and use of high-privilege GitHub tokens, turning casual conversation into unintended code or account actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script requires a GitHub token and immediately uses it for authenticated API requests to fetch the current user and enumerate repositories, but it does not clearly warn the caller that token-backed network requests will be performed. In an agent-skill context, hidden authenticated outbound requests are security-relevant because they can expose account metadata usage and cause actions to occur under the user's identity without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code performs a state-changing POST to the GitHub Actions workflow_dispatch endpoint, which triggers remote workflow execution in the user's repository, but it does so without an explicit warning or confirmation step. In an agent environment, silently causing remote automation to run under user credentials is dangerous because workflows may execute arbitrary repository-defined code and consume secrets, CI minutes, or perform further side effects.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Enable GitHub Actions (they're disabled by default on forks)
echo "⚡ Enabling GitHub Actions..."
curl -s -X PUT \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \

• Confidence: 95% confidence
• Finding: curl -s -X PUT \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \ -d '{"enab

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X PUT \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \
  -d '{"enabled": true, "allowed_actions": "all"}' > /dev/null

# Trigger the genesis workflow if it exists

• Confidence: 96% confidence
• Finding: https://api.github.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/workflows/genesis.yml/dispatches" \
  -d '{"ref": "main"}' 2>/dev/null || true

# Enable GitHub Pages

• Confidence: 94% confidence
• Finding: https://api.github.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

# Try different workflow names
for WORKFLOW in "daily-evolution.yml" "evolve.yml" "daily.yml"; do
  RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
    -H "Authorization: token $GITHUB_TOKEN" \
    -H "Accept: application/vnd.github.v3+json" \
    "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/workflows/$WORKFLOW/dispatches" \

• Confidence: 95% confidence
• Finding: curl -s -o /dev/null -w "%{http_code}" -X POST \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NA

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.