Eval Repo

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:29 PM UTC
• Version: 3.1.1

Overview

The skill broadly matches its stated purpose, but it uses admin-backed Gitea access and can persistently modify shared knowledge-base and control-plane repositories.

Install only if you trust the publisher and are comfortable giving the skill admin-level Gitea credentials. Prefer a least-privilege token limited to the intended KB repos, and verify that writes to system-config, catalog.json, index.md, and evaluation files are expected in your deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require network access, file reads/writes, and likely environment/context access via local scripts. This undermines least-privilege enforcement and prevents reviewers or runtime policy from accurately understanding what the skill can do, which increases the chance of unintended data access or unauthorized side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior says the skill evaluates a GitHub repository and saves a report, but the described scripts also resolve chat identity, read central binding/config data, and modify Gitea-hosted knowledge-base repositories and indexes. This scope expansion is security-relevant because operators may authorize the skill for benign evaluation while it actually gains access to sensitive organizational metadata and can write to shared repositories.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Requesting a Gitea admin token for a skill whose stated purpose is repository evaluation and KB writing is excessive privilege and creates a real security risk. If the skill or its dependencies are compromised, an admin token could enable broad repository access, administrative actions, secret exposure, or system-wide changes far beyond the declared function.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata says it should fetch repository metadata and files, generate an evaluation, and save that evaluation to a target knowledge base. This helper instead writes back to the source repository via g.put_file("catalog.json"), creating side effects outside the declared scope; in an automated agent context, that can silently modify user repositories and violate least-astonishment and change-control expectations.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: regen_index constructs content and writes index.md directly into the repository, which exceeds the described behavior of evaluating a repo and saving results to a knowledge base. In practice, this gives the skill undocumented write capability over repository contents, increasing the risk of unintended file changes, workflow disruption, or abuse if invoked on arbitrary repos.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This module is for a repository-evaluation skill, but it includes broad administrative and write-capable operations such as site-admin checks, creating repositories, adding collaborators, and writing remote files. In this context, those capabilities exceed least privilege and create a path for unintended or unauthorized modification of the Gitea instance if the skill is triggered or misused.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The code can create repositories and perform remote file writes, which goes beyond merely fetching metadata and generating an evaluation. Because the skill description frames this as an evaluation workflow, these hidden mutation capabilities are dangerous: they enable persistence, tampering with repositories, or silent side effects under the guise of analysis.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module initializes and mutates a separate control-plane repository named 'system-config' and writes operational state into it, which is unrelated to the declared skill purpose of evaluating repositories and saving evaluations. In this context, the code grants the skill persistent side effects over bot-owned infrastructure data, creating an unnecessary capability that could be abused to alter platform state or silently store unauthorized data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file manages users, teams, chat bindings, jobs, tasks, and permissions state despite the skill being described only as fetching repository metadata and generating evaluations. That mismatch indicates over-privileged functionality and expands the blast radius: if invoked or modified maliciously, the skill could interfere with identity, authorization, and task orchestration data far beyond its stated purpose.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code performs repository writes without any visible confirmation, disclosure, or approval check at the point of modification. In an agent skill, silent writes are dangerous because users may reasonably expect analysis-only behavior, yet the tool can commit changes to repository state without informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Index regeneration writes index.md without any user-facing warning in this code path, despite the skill presenting as an evaluation tool. Because the generated file is derived from repository data and written automatically, this can create unauthorized content changes and surprise commits in user repositories.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module silently loads and uses an administrative token from environment configuration without any disclosure to the user that privileged credentials are being exercised. In a skill that appears to perform evaluation, undisclosed privileged access increases the risk of trust boundary violations and unexpected high-impact actions if the module is repurposed or abused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Repository creation and modification operations are present without visible disclosure or obvious approval checks. In the context of an evaluation skill, these side effects are misleading and can result in unauthorized repository changes that a user would not reasonably expect from the stated functionality.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module can write arbitrary content and bytes to remote repository paths, yet there is no visible warning, confirmation, or restriction mechanism. This is risky because an evaluation-oriented skill could be used to overwrite files, plant content, or alter evidence, especially when paired with powerful credentials.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code performs repository-backed initialization and updates of system state without any user-facing disclosure, consent flow, or obvious indication in the skill behavior. Hidden persistent writes are dangerous because they can surprise operators, conceal data collection or control-plane changes, and make misuse harder to detect during routine use of what appears to be a repository-evaluation tool.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def headers() -> dict:
    h = {"Accept": "application/vnd.github+json", "User-Agent": "paper-kb-v3"}
    token = os.environ.get("GITHUB_TOKEN", "").strip()
    if token:
        h["Authorization"] = f"Bearer {token}"
    return h

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 97% confidence
• Finding: The dependency `requests` is unpinned, so installations may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a skill that fetches remote GitHub content and writes evaluations into a knowledge base, uncontrolled dependency drift increases supply-chain risk and can expose the environment to dependency-based compromise or unexpected behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 96% confidence
• Finding: The dependency `python-dotenv` is also unpinned, which allows non-reproducible installs and increases exposure to future vulnerable or incompatible releases. Although lower risk than a network-facing library, this still weakens supply-chain integrity for the skill's execution environment.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: `requests` is flagged with multiple known advisories, and because the requirement is unpinned, dependency resolution may install a vulnerable version. This is especially concerning in a skill whose core purpose is fetching remote repository metadata and files, because vulnerable HTTP handling can directly affect confidentiality, integrity, or request authentication when interacting with attacker-controlled URLs or responses.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: `python-dotenv` is reported with a known advisory involving symlink following during `set_key`, and the unpinned requirement may permit installation of an affected version. The impact depends on whether the skill actually modifies `.env` files, but as a package-level issue it remains a real supply-chain vulnerability that could become exploitable if that functionality is used now or later.

Static analysis

No suspicious patterns detected.