Security audit

skill-github-project-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward GitHub project analysis skill that uses public web lookup and saves a local Markdown report, with minor scoping and disclosure notes but no evidence of malicious behavior.

Before installing, expect the skill to browse public GitHub/web sources and create a Markdown report in a local GitHub项目分析 folder. If you provide only a project name, confirm the exact repository first to avoid analyzing the wrong project.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase for '快速分析一下这个项目' is broad enough that ordinary user requests about analyzing a project could invoke this skill even when the user did not clearly intend GitHub-specific analysis. Over-broad activation can cause incorrect tool/skill routing, unexpected external lookups, or unintended handling of ambiguous inputs.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Allowing activation from only a project name like '分析 React 项目' is ambiguous because many project names are overloaded and may refer to non-GitHub entities, unofficial forks, or unrelated content. This increases the risk of the skill selecting the wrong target, performing unintended searches, or presenting analysis of an unintended repository as authoritative.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The catch-all invitation '任何你想了解的项目' combined with example links encourages extremely broad use and weakens scope boundaries for when the skill should activate. In an agent environment, this can make the skill fire on generic project-analysis requests and lead to unnecessary browsing/search behavior or misrouting away from more appropriate skills.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation description is broad enough that routine requests about GitHub projects could trigger the skill unexpectedly. In this skill's context, accidental activation matters because the workflow includes network retrieval and writing reports to a local directory, which can cause unintended external access or file creation without clear user intent.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to generate and save a report under `./GitHub项目分析/` without clearly disclosing that local filesystem writes will occur. This is risky because users may believe they are only requesting analysis text, while the agent persists data on disk, potentially creating privacy, consent, or workspace-integrity issues.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: L221-L223 明确写“本技能为框架指导型，无需 Python 脚本”，给人的预期是该技能不涉及实际执行层面的外部操作。但后文 L259-L283 又具体要求调用 fetch_web、search_web，并将 Markdown 报告保存到本地路径，这已经不是纯粹的“仅框架指导”描述，构成文档层面的主动误导。

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: L242-L244 明确规定“全部中文输出”，这是对输出语言的硬性限制，但文档没有提供用户选择其他语言的选项，也没有说明该限制仅适用于特定地区或合规场景。根据规则，未经用户选择而强制特定语言属于自然语言层面的政策问题。

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The document is entirely framed in Chinese and explicitly targets the executing agent with Chinese templates and examples, which creates a de facto language constraint. There is no indication that the user can choose another language or that the skill is region-specific, so this conflicts with the policy against forcing a language without opt-in.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The entire usage guide is presented only in Chinese and does not mention any option for users to choose another language. This can be a natural-language policy concern when a skill effectively enforces a specific language without documented opt-in or justification.

Static analysis

No suspicious patterns detected.