Github Bounty Finder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.0.1

Overview

This appears to be a normal bounty-scanning CLI, but users should handle the required API tokens carefully.

Use least-privilege, revocable GitHub and Algora tokens; keep any .env file out of source control and rotate tokens if exposed. For stricter environments, ask the publisher for pinned dependency versions and a lockfile before installing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Credential Access

High

• Category: Privilege Escalation

Content

clawhub install github-bounty-finder

# Configure
echo "GITHUB_TOKEN=your_token" > .env
echo "ALGORA_API_KEY=your_key" >> .env

# Scan for bounties

• Confidence: 89% confidence
• Finding: The command writes a GitHub token directly into a .env file from the shell, which may normalize insecure handling of credentials and increase risk of accidental disclosure. While not credential theft by itself, the documentation encourages storage of sensitive secrets in plaintext without safeguards, creating a realistic path to exposure.

Credential Access

High

• Category: Privilege Escalation

Content

# Configure
echo "GITHUB_TOKEN=your_token" > .env
echo "ALGORA_API_KEY=your_key" >> .env

# Scan for bounties
github-bounty-finder scan

• Confidence: 89% confidence
• Finding: The Algora API key is written to a plaintext .env file with no warning about secure storage or repository exclusion. In the context of a developer tool likely used inside project directories, this raises the chance of committing or sharing active API credentials unintentionally.

Credential Access

High

• Category: Privilege Escalation

Content

### Getting API Keys

1. **GitHub Token**: 
   - Go to GitHub Settings → Developer settings → Personal access tokens
   - Create a token with `public_repo` scope

2. **Algora API Key**:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

console.log(`   ALGORA_API_KEY: ${process.env.ALGORA_API_KEY ? chalk.green('✓ Set') : chalk.red('✗ Not set')}\n`);
    
    if (!process.env.GITHUB_TOKEN || !process.env.ALGORA_API_KEY) {
      console.log(chalk.yellow('📝 Create a .env file with:\n'));
      console.log('   GITHUB_TOKEN=your_github_token');
      console.log('   ALGORA_API_KEY=your_algora_api_key\n');
    }

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "requirements": [
    "Node.js 18.0.0 or higher",
    "GitHub Personal Access Token (free)",
    "Algora API Key (free)"
  ],
  "changelog": [

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly instructs users to place long-lived API credentials into a local .env file but provides no guidance on secret hygiene such as adding .env to .gitignore, avoiding shell history leakage, or using a secure secret manager. This can lead to accidental credential exposure through source control, local backups, logs, or copied setup snippets, especially for less experienced users.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This is a manifest file, so vague-trigger review applies. The description says the skill will "Scan Algora/GitHub for high-value bounties" but does not define specific trigger phrases, scope limits, or negative examples, which could make activation criteria overly broad in orchestration systems that rely on manifest text.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manifest explicitly requires a GitHub Personal Access Token and Algora API key but provides no warning about how those credentials are handled, stored, or transmitted. In a network-scanning automation tool, that omission increases the risk of users supplying sensitive tokens without informed consent, especially if the skill later sends them to external services or logs them.

External Transmission

Medium

• Category: Data Exfiltration

Content

try {
      // Algora API endpoint (adjust based on actual API)
      const response = await axios.get('https://api.algora.io/v1/bounties', {
        headers: {
          'Authorization': `Bearer ${this.algoraApiKey}`
        },

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The markdown instructs users to place a GitHub personal access token and an Algora API key in a .env file, but it does not include any caution about handling these secrets securely. Because credential storage and transmission can affect user privacy and account security, the skill description should disclose this risk and basic safe-handling expectations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "OpenClaw Skills",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",

• Confidence: 95% confidence
• Finding: The dependency uses a caret range instead of an exact pinned version, so installs can drift to newer releases over time. This weakens build reproducibility and can unintentionally pull in vulnerable or malicious upstream updates, creating supply-chain risk even though the manifest itself is not directly exploitable.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: Axios has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to verify from this file whether the installed release is affected. In a scanner skill that likely makes outbound HTTP requests, a vulnerable HTTP client could enable SSRF-related bypasses, header mishandling, or other request/response security issues depending on usage.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"

• Confidence: 95% confidence
• Finding: Using a non-exact version for chalk allows future compatible releases to be installed implicitly. In a CLI skill that depends on third-party npm packages, this increases supply-chain exposure and makes the runtime contents less predictable.

Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 62% confidence
• Finding: A known advisory exists for chalk, and the unpinned manifest prevents confirming whether the resolved version is safe. Because chalk is typically used only for terminal formatting, the practical exploitability in this skill is lower, but it still represents avoidable supply-chain uncertainty.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },

• Confidence: 94% confidence
• Finding: The commander dependency is not pinned to a single exact release, so different environments may resolve different package contents. This is a classic software supply-chain hygiene issue that can expose consumers to unreviewed upstream changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },
  "engines": {

• Confidence: 94% confidence
• Finding: The dotenv package is specified with a caret range, allowing automatic uptake of later patch/minor versions. While common in development, it still creates avoidable supply-chain and reproducibility risk for a distributed skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },
  "engines": {
    "node": ">=18.0.0"

• Confidence: 95% confidence
• Finding: The node-fetch dependency is not pinned, which permits version drift and complicates verification against known advisories. For tooling that performs network access, dependency integrity matters because compromised libraries can directly affect outbound requests and data handling.

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: Node-fetch has multiple historical advisories, and the unpinned range means the actual installed version cannot be validated from the manifest alone. Since this skill appears to scan remote services, an affected fetch library could expose request metadata, mishandle redirects, or introduce denial-of-service risk through inefficient parsing behavior.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/scanner.js:11

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:69