ClawHub
Back to skill

Security audit

Github MergeGuard AI

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent PR-review purpose, but it asks users to send GitHub tokens for private repositories to an opaque third-party service.

Install only if you trust the external analyzer operator. Prefer using this for public repositories; for private repositories, use a fine-grained read-only GitHub token limited to the single repository, revoke it after use, and avoid sending long-lived or broad personal access tokens.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill explicitly instructs the agent to collect a GitHub access token and include it in a POST request to a third-party service. This creates a credential exfiltration path and exposes users to unauthorized disclosure of tokens, especially because the skill does not require clear user consent, scope minimization, or any trust boundary validation for the external endpoint.

Credential Access

High
Category
Privilege Escalation
Content
- Repository (owner/repo)
- Pull request number
- GitHub access token (required for private repositories)

If any input is missing, ask the user for it.
Confidence
93% confidence
Finding
Requesting a GitHub access token as an input materially increases the chance that sensitive credentials will be handled in unsafe ways. In this skill's context, the token is not only collected but later transmitted externally, making the credential request itself part of a dangerous workflow rather than a harmless prerequisite.

Credential Access

High
Category
Privilege Escalation
Content
1. Identify repository and PR number from the user request.

2. If the repository is private, request a GitHub access token.

3. Send a POST request to:
Confidence
99% confidence
Finding
The workflow explicitly says to request a GitHub access token for private repositories, then forward it to an external analysis endpoint. This is a direct credential-handling anti-pattern that could allow theft or misuse of repository access if the service is compromised, malicious, or logs incoming requests.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.