Github MergeGuard AI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:13 PM UTC
• Version: 1.0.0

Overview

This skill has a clear PR-risk-analysis purpose, but it asks for GitHub tokens for private repositories and sends them to an external service without enough consent, scoping, or trust details.

Review this carefully before installing. Use it only for public repositories or with a narrowly scoped, short-lived, read-only token that you are comfortable sending to the named external service. Do not provide organization-wide, write, workflow, or admin-scoped GitHub tokens unless the service owner, retention policy, and credential handling are independently trusted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Disclosure of GitHub Access Tokens to an Unverified Third-Party Service

Content

View full analysis

", "pr_number": , "github_token": "" } ``` `references/api.md:1-7`: ```markdown Endpoint: POST https://pr-risk-analyzer.onrender.com/analyze-pr Request body: repo: string (owner/repo) pr_number: number github_token: optional string ``` ### Technical Analysis The skill explicitly instructs the agent to request a GitHub access token for private repositories and include that credential in an HTTP POST request sent to `pr-risk-analyzer.onrender.com`. This transfers a reusable authentication secret to an externally hosted service. The reviewed package contains no implementation or documentation establishing the endpoint's ownership, trust boundary, source-code provenance, data-retention policy, credential handling controls, or protection against server compromise. It also does not require a narrowly scoped token, a short-lived credential, or a read-only GitHub App installation token. The guardrail stating that tokens must not be exposed or stored does not mitigate this issue because the workflow intentionally discloses the token to the remote endpoint. Once transmitted, the skill cannot enforce whether the receiving service logs, stores, forwards, or misuses it. ### Attack Path 1. A user asks the skill to analyze a pull request in a private repositor ...[truncated 1385 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill explicitly asks the user for a GitHub access token as an input, which is sensitive credential material. Requesting credentials in conversational flow is dangerous because it normalizes secret sharing with the agent and sets up later transmission to an external service.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- Repository (owner/repo)
- Pull request number
- GitHub access token (required for private repositories)

If any input is missing, ask the user for it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The workflow directs the agent to request a GitHub access token for private repositories, reinforcing credential collection as a normal action and tying it directly to an external network request. In context, this is more dangerous because the token is not only collected but then used outside GitHub, expanding exposure to third-party compromise or misuse.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

1. Identify repository and PR number from the user request.

2. If the repository is private, request a GitHub access token.

3. Send a POST request to:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to collect a GitHub access token and transmit it to a third-party service, but does not require explicit informed user consent or warn that credentials are leaving the GitHub trust boundary. This creates a direct credential exfiltration path to an external endpoint and could expose private repository access if the service is compromised, malicious, or logs tokens insecurely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger 'Analyze a pull request' is broad enough to match routine PR review requests, causing the skill to activate in cases where users may not expect an external service call or credential request. Overbroad activation increases the chance of unnecessary data sharing, including repository metadata and possibly tokens for private repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.