ClawHub
Back to skill

Security audit

Github Contribution

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent for GitHub contribution automation, but it includes destructive Git synchronization steps that can discard local work and push changes without enough warning or confirmation.

Review before installing. Use this only in fresh or disposable clones, or after backing up/stashing local work. Before running the script, verify the project directory, origin, upstream, current branch, and `git status`; avoid running it in a repository that has uncommitted, untracked, or ignored files you care about. Prefer a dry-run cleanup and explicit confirmation before hard resets or pushes.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents a synchronization sequence that forcefully resets the branch and deletes all untracked files, but it does not provide an explicit warning that local changes, generated artifacts, secrets in untracked files, and other user data may be irreversibly destroyed. In an agent skill context, users may follow or automate these commands with elevated trust, making accidental data loss more likely.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script performs `git reset --hard` and then pushes the result to the user's fork without an explicit destructive-action confirmation immediately before doing so. This can permanently discard uncommitted local work in an existing project directory, which is risky in an automation script because the user may not realize the directory will be forcibly rewritten.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git checkout main
git fetch upstream
git reset --hard upstream/main
git clean -fdx  # Remove all untracked files

# Verify clean state
Confidence
98% confidence
Finding
`git reset --hard upstream/main` forcibly discards local commits and working-tree changes on the checked-out branch. In a skill that guides automation of repository operations, this is dangerous because a user or agent may execute it in the wrong repository or branch, causing irreversible loss of work and potentially overwriting intentionally divergent state.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git checkout main
git fetch upstream
git reset --hard upstream/main
git clean -fdx  # Remove all untracked files

# Verify clean state
if [[ $(git status --porcelain) ]]; then
Confidence
99% confidence
Finding
`git clean -fdx` deletes all untracked files and directories, including ignored files such as local configuration, build outputs, and possibly credential-containing artifacts. In this skill context, that makes the command especially risky because it is presented as a routine cleanup step in a contribution workflow, increasing the chance it will be run without understanding the scope of deletion.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
echo "🔄 同步你的 Fork 到官方最新状态"
git checkout main 2>/dev/null || git checkout master
git fetch upstream
git reset --hard upstream/main 2>/dev/null || git reset --hard upstream/master

# 6. 推送同步后的更改到你的 Fork
echo "📤 推送同步后的代码到你的 Fork"
Confidence
97% confidence
Finding
This duplicate finding is valid for the same reason: the script invokes a destructive Git parameter combination that can wipe local work. Because it then pushes the synchronized branch to `origin`, the operation can also overwrite the user's fork state and propagate mistakes beyond the local machine.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
echo "🔄 同步你的 Fork 到官方最新状态"
git checkout main 2>/dev/null || git checkout master
git fetch upstream
git reset --hard upstream/main 2>/dev/null || git reset --hard upstream/master

# 6. 推送同步后的更改到你的 Fork
echo "📤 推送同步后的代码到你的 Fork"
Confidence
97% confidence
Finding
This duplicate finding is valid for the same reason: the script invokes a destructive Git parameter combination that can wipe local work. Because it then pushes the synchronized branch to `origin`, the operation can also overwrite the user's fork state and propagate mistakes beyond the local machine.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.