T09 · Insecure Skill Coding Practices
Error
- Location
scripts/repo-detail.mjs:13- Finding
Shell Command Injection Through Repository Name
- Content
View full analysis
- Remediation
View remediation
Security audit
github-search
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate GitHub research purpose, but its bundled scripts can turn user-supplied arguments into shell command execution while using inherited environment credentials.
Review before installing. The skill is coherent as a GitHub research helper, but it should not be run on untrusted or agent-generated repository names, sort values, or order values until the shell-based curl calls are replaced with structured HTTP requests and strict allowlists. Avoid setting GITHUB_TOKEN in the environment for this skill unless you accept that the current implementation may expose it if command injection is triggered.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/github-search.mjs:96- Finding
Shell Command Injection Through Search Sort and Order Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/github-search.mjs "agent memory"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation is written entirely in Chinese, including usage instructions, parameters, and examples, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. This can violate language/locale policy because it imposes a specific language on users without opt-in or justification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill demonstrates capabilities that involve shell execution, network access, and environment-variable use, but it does not declare any tool scope or permissions boundaries. That increases the chance an agent runtime will invoke the skill with broader-than-necessary privileges, making misuse of shell/network operations or secret-bearing environment variables harder to govern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The description and instructions consistently force Chinese-language interaction/documentation, with no opt-in, alternative language option, or justification that the skill is intended only for a Chinese-language or region-specific audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
User-influenced values flow into a shell command via the URL, sort, and order parameters, and the command is executed by execSync. encodeURIComponent protects the query portion, but sort and order are not validated and shell metacharacters could break out of the quoted URL, leading to arbitrary command execution in the context running the skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script builds a shell command string and executes it with execSync while also pulling credentials from GITHUB_TOKEN. Although the feature goal is legitimate, invoking curl through the shell unnecessarily expands the attack surface and can expose the token or enable command injection if supposedly constrained inputs such as sort/order are manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads
process.env.GITHUB_TOKENand, if present, transmits it in an Authorization header to GitHub. This is access to sensitive credentials and network transmission of authentication data, but the usage/help text and nearby comments do not warn the user that an environment token may be consumed and sent.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script builds a shell command string and executes it with execSync using untrusted input derived from the repoFullName argument and an environment-sourced GitHub token. Because repoFullName is interpolated into a quoted shell command without strict validation or escaping, an attacker can potentially achieve command injection or break command structure, which is especially dangerous in an agent skill that may process external/user-supplied repository names.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js import { execSync } from 'child_process'; const GITHUB_API = 'https://api.github.com/repos'; // 解析参数 function parseArgs() {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js import { execSync } from 'child_process'; const GITHUB_API = 'https://api.github.com/repos'; // 解析参数 function parseArgs() {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script explicitly formats dates with the 'zh-CN' locale, which hard-codes a language/locale choice rather than adapting to user preference. This is reinforced by multiple Chinese user-facing messages throughout the script, with no opt-in or alternative locale handling.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation instructs users to export a GitHub token but does not warn that the credential will be consumed by authenticated requests or describe safe handling practices. This can lead to users placing long-lived tokens in insecure shells, logs, shared environments, or transcripts, increasing the risk of accidental credential exposure.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/github-search.mjs:105
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/repo-detail.mjs:36