Security audit

Git Hub CLI省Token只读工具集

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent read-only GitHub helper, but it can invoke GitHub authentication and token-backed API access under broad triggers without enough user consent or scope guidance.

Install only if you are comfortable with an agent using your GitHub CLI login or GITHUB_TOKEN for read access. Prefer a least-privilege token, avoid using accounts with broad private-repo access, and treat cached outputs in temporary files as potentially containing private repository data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to run `gh auth status || gh auth login` before use. In an automated or semi-automated agent context, this can trigger an interactive authentication flow that may request broader GitHub permissions than the read-only purpose of the skill, expanding credential exposure and privilege scope.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The fallback `curl` example sends `GITHUB_TOKEN` directly in an Authorization header. Although the destination is GitHub, embedding token-bearing raw HTTP expands the skill beyond a pure CLI wrapper, increases the chance of credential mishandling in logs or copied commands, and bypasses some CLI guardrails.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger list includes broad terms like `github`, `repo`, `pr`, `issue`, and `ci`, which are common in normal user conversations. This can cause the skill to activate unexpectedly and perform networked repository queries or auth-related actions in contexts where the user did not intend to invoke it.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill describes authentication behavior and token-backed API use but does not clearly warn the user that credentials may be used or that GitHub account context affects data access. In an agent setting, missing credential-use disclosure can lead to unintended authenticated requests and overcollection from private repositories.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The fallback example uses `GITHUB_TOKEN` directly in a request without an explicit warning that credentials are being transmitted to GitHub APIs. This is risky because users or downstream agents may copy the pattern without understanding the sensitivity of the token or the need to minimize scope and logging.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: The trigger `gh` is extremely short and likely to match unintended inputs, especially in technical conversations. Accidental activation is more concerning here because the skill can initiate authentication checks and network requests.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 84% confidence
Finding: The trigger `pr` is a common abbreviation that may appear in many unrelated contexts. This broad matching increases the chance of unintended skill activation and associated GitHub API calls.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 82% confidence
Finding: The trigger `ci` is too generic and may match ordinary references to continuous integration or unrelated abbreviations. Given the skill's ability to inspect CI runs and logs, accidental activation could expose private build metadata unnecessarily.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.