ClawHub
Back to skill

Security audit

ForkZoo

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it asks for powerful GitHub access and automatically enables workflows and public publishing.

Review before installing. Use a dedicated fine-grained or temporary GitHub token limited to the intended pet repository where possible, inspect the forkZoo repositories and workflows before adoption, and be ready to disable Actions, disable Pages, revoke the token, or delete the fork when you no longer want the automation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to execute local shell scripts such as `./scripts/adopt.sh` and `./scripts/interact.sh`, but the manifest does not declare corresponding permissions or clearly constrain when shell execution is allowed. This creates a trust and review gap: an agent may invoke code-capable behavior without explicit permission metadata, and the scripts are intended to use high-privilege GitHub credentials (`repo` and `workflow` scopes), increasing the risk of repository compromise or unintended account actions if the skill or its referenced scripts are modified or abused.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script explicitly enables GitHub Actions on the newly forked repository and sets "allowed_actions" to "all", which grants broad workflow execution capability unrelated to the minimal act of adopting a digital pet. Because the forked template repository may contain workflows and future workflow changes can execute code in the user's repository context, this increases the attack surface and can enable arbitrary CI execution with repository privileges.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The script automatically provisions GitHub Pages for the forked repository, publishing repository content at a public URL. For a pet-adoption workflow this may be feature-related, but automatically making content web-accessible creates an unnecessary exposure if the repository contains unexpected files, generated content, or future modifications.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest description includes broad trigger language such as pet-related requests, tamagotchi mentions, and especially generic phrases like `my pet` queries, which can match ordinary conversation that is not actually asking to use this skill. Over-broad activation can cause the agent to load a shell-capable skill unexpectedly, raising the chance of unnecessary credential requests or accidental execution paths tied to GitHub operations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script changes repository security-sensitive settings by enabling Actions without any explicit warning or consent flow. Users may provide a token for a harmless-sounding pet skill without realizing the script is authorizing automated code execution in the new repository.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automatically dispatches the genesis workflow immediately after enabling Actions, causing code defined in the forked repository to run without a separate user approval step. In this context, a pet-adoption action should not silently trigger workflow execution, especially when the workflow contents are not surfaced to the user.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script enables GitHub Pages with no warning that repository content will be published publicly under the user's GitHub Pages domain. This creates an avoidable privacy and exposure risk because users may not expect adoption of a digital pet to create a public website.

External Transmission

Medium
Category
Data Exfiltration
Content
# Enable GitHub Actions (they're disabled by default on forks)
echo "⚡ Enabling GitHub Actions..."
curl -s -X PUT \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \
Confidence
90% confidence
Finding
curl -s -X PUT \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \ -d '{"enab

External Transmission

Medium
Category
Data Exfiltration
Content
# Enable GitHub Pages
echo "🌐 Setting up GitHub Pages..."
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/pages" \
Confidence
86% confidence
Finding
curl -s -X POST \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/pages" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X PUT \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/permissions" \
  -d '{"enabled": true, "allowed_actions": "all"}' > /dev/null

# Trigger the genesis workflow if it exists
Confidence
90% confidence
Finding
https://api.github.com/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/actions/workflows/genesis.yml/dispatches" \
  -d '{"ref": "main"}' 2>/dev/null || true

# Enable GitHub Pages
Confidence
88% confidence
Finding
https://api.github.com/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/$GITHUB_USER/$REPO_NAME/pages" \
  -d '{"source": {"branch": "main", "path": "/"}}' 2>/dev/null || true

PAGES_URL="https://$GITHUB_USER.github.io/$REPO_NAME/"
Confidence
85% confidence
Finding
https://api.github.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.