ClawHub
Back to skill

Security audit

Issue Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a GitHub issue-finding helper whose commands, script, and reports fit its stated purpose, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install this if you want Codex to help find and evaluate GitHub contribution opportunities. Expect it to use the GitHub CLI, read repository context, query GitHub, and optionally write a local markdown report; review any proposed issue comments, branch creation, or PR work before allowing account-changing actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs use of shell commands (`gh`, `git`, `find`, `grep`, `python3`) and mentions writing outputs like reports, but it does not declare any `permissions` or `allowed-tools` scope. This creates a capability/authorization mismatch: an agent may invoke broader shell or file-write access than a reviewer expects, increasing the risk of unintended command execution, repository modification, or data exposure when the skill is run in a permissive environment.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill text switches into Chinese for a substantial instructional section, including headings, concepts, and label guidance, while the rest of the document is in English. This imposes a language requirement on users without opt-in or justification, which is a natural-language policy concern under the language/locale rule.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_gh_command(args: list[str]) -> dict[str, Any] | list[Any] | None:
    """Run a gh CLI command and return JSON output."""
    try:
        result = subprocess.run(
            ["gh"] + args,
            capture_output=True,
            text=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.