Security audit

skill-d-create-issues

Security checks across malware telemetry and agentic risk

Overview

This skill matches its meeting-to-issue purpose, but needs Review because it can modify Gitea, expose meeting/contact data, and run a public webhook with weak defaults.

Install only in a trusted Gitea environment after tightening controls: use HTTPS, set WEBHOOK_SECRET, restrict the bot token to intended repositories, add status and approval checks inside create_issues.py and finish.py, treat email outputs as sensitive, and replace shell sourcing of .env with safe key/value parsing. The package also contains Python syntax errors in check.py and finish.py, so it may not run correctly as published.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script's stated purpose is a prerequisite check, but it additionally enumerates repository members and resolves attendee/organizer email addresses, then emits them in JSON output. This expands data access beyond what is necessary for validation and can expose personal information to downstream consumers, logs, or other agents without a clear need-to-know.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring says the script checks prerequisites and returns confirmed_issue.md content plus meeting metadata, but the implementation also retrieves minutes content and user/member email information. This documentation mismatch is dangerous because operators may authorize or run the skill under a narrower trust assumption than the code actually follows, leading to unintended data exposure.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The module docstring claims it appends logs to a local path, but the implementation actually performs authenticated HTTP reads and writes to a remote repository API. This mismatch hides data exfiltration behavior from reviewers and users, making consent, auditability, and threat assessment materially harder.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs operators to expose a webhook endpoint on a public IP and to send meeting content and participant email data through outbound email, but it provides no user-facing disclosure, consent, or data-classification guidance. Because the workflow handles confirmed_issue.md, minutes.md, organizer and attendee emails, and repository metadata, it can transmit potentially sensitive internal information off-host or to unintended recipients without adequate transparency or safeguards.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script resolves and outputs attendee and organizer email addresses without any warning, consent mechanism, or indication that personally identifiable information will be collected and emitted. In agent workflows, stdout is often logged or passed to other components, so this can leak contact information beyond the immediate task context.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The script looks up assignee email addresses via API and returns them in structured output without any minimization or explicit authorization checks. In environments where email addresses are private or the token can query broader user data, this creates unnecessary exposure of personal contact information and expands the privacy impact of the skill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The function sends log entries to a remote repository service without any user-facing disclosure, confirmation, or visible policy enforcement. If entries contain prompts, outputs, identifiers, or operational metadata, this can leak sensitive information to an external system under the guise of ordinary logging.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: A repository access token is directly used for authenticated network operations, but the code provides no safeguards, validation, or disclosure around credential handling. In a skill context, this increases the risk of over-privileged token misuse, accidental transmission to untrusted endpoints via base_url, and difficult-to-audit secret exposure patterns.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script executes `source "$ENV_FILE"`, which treats the .env file as shell code, not just key/value data. If that file is modified by an attacker or contains unexpected shell syntax, arbitrary commands will run in the user's shell during setup, potentially exposing credentials or compromising the host. In this context the file is expected to contain sensitive tokens, which increases the damage from any malicious modification.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: main.js:37