Security audit

Repo PR Triage

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed GitHub PR triage tasks, with a real caution that repository text can influence generated prompts and should be reviewed before use.

Use this with repositories you trust or review the generated interview prompt before letting an agent act on it. Treat README, PR bodies, releases, and report text as untrusted; do not allow automatic labeling, closing, or posting based only on the generated output without human review.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboard.py:103
Finding: Indirect Prompt Injection Through Untrusted Repository Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a broader triage system for both PRs and issues, with onboarding, scanning, de-duplication, and reporting. The supplied code only implements the scanning portion for open pull requests. It fetches PR metadata with gh CLI, parses a local vision document for green/red keywords, scores PRs using fixed heuristics, identifies possible duplicate PRs by title overlap, and writes JSON. There is no code for interviewing a repo owner, generating a vision document, triaging issues, or producing markdown reports. The primary purpose is adjacent to the description but materially narrower, so this is a mismatch.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/example-vision.md (reported line 154)May include surrounding context.
md
### From Lex Fridman Podcast #491: - "AI agents will replace 80% of apps" (timestamp 3:02) - Discussed acquisition offers from OpenAI and Meta (chose OpenAI for alignment) - "Self-modifying AI agent" as a core concept - Security concerns discussed at length (1:02:26) ### From README:

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/onboard.py (reported line 166)May include surrounding context.
python
Use `references/rubric-template.md` as the starting template for the rubric. """ return prompt def main():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_onboard.py (reported line 27)May include surrounding context.
python
self.assertEqual(onboard.parse_repo("owner/repo"), "owner/repo") def test_path_traversal(self): result = onboard.parse_repo("https://github.com/../../etc/passwd") self.assertIsInstance(result, str) def test_url_with_semicolon(self):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_scan.py (reported line 30)May include surrounding context.
python
self.assertEqual(onboard.parse_repo("owner/repo"), "owner/repo") def test_path_traversal(self): result = onboard.parse_repo("https://github.com/../../etc/passwd") self.assertIsInstance(result, str) def test_url_with_semicolon(self):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_scan.py (reported line 128)May include surrounding context.
python
self.assertEqual(onboard.parse_repo("owner/repo"), "owner/repo") def test_path_traversal(self): result = onboard.parse_repo("https://github.com/../../etc/passwd") self.assertIsInstance(result, str) def test_url_with_semicolon(self):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_onboard.py (reported line 114)May include surrounding context.
python
def test_shell_injection_in_repo_name(self): ctx = {"metadata": {"name": "$(rm -rf /)", "description": "", "stargazerCount": 0, "primaryLanguage": {"name": "Python"}, "repositoryTopics": []}} prompt = onboard.generate_interview_prompt("$(rm -rf /)/repo", ctx) # Just verify it produces a string without crashing self.assertIsInstance(prompt, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_report.py (reported line 86)May include surrounding context.
python
self.assertIn("none", md) def test_shell_injection_in_title(self): pr = _make_scored_pr(title="$(rm -rf /)") md = report.pr_to_markdown(pr, "owner/repo") self.assertIn("$(rm -rf /)", md)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 319)May include surrounding context.
python
self.assertIn("none", md) def test_shell_injection_in_title(self): pr = _make_scored_pr(title="$(rm -rf /)") md = report.pr_to_markdown(pr, "owner/repo") self.assertIn("$(rm -rf /)", md)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 322)May include surrounding context.
python
self.assertIn("none", md) def test_shell_injection_in_title(self): pr = _make_scored_pr(title="$(rm -rf /)") md = report.pr_to_markdown(pr, "owner/repo") self.assertIn("$(rm -rf /)", md)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_onboard.py (reported line 112)May include surrounding context.
python
def test_shell_injection_in_title(self): pr = _make_scored_pr(title="$(rm -rf /)") md = report.pr_to_markdown(pr, "owner/repo") self.assertIn("$(rm -rf /)", md) class TestGenerateReport(unittest.TestCase):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_report.py (reported line 88)May include surrounding context.
python
def test_shell_injection_in_title(self): pr = _make_scored_pr(title="$(rm -rf /)") md = report.pr_to_markdown(pr, "owner/repo") self.assertIn("$(rm -rf /)", md) class TestGenerateReport(unittest.TestCase):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_onboard.py (reported line 112)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_onboard.py (reported line 114)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_report.py (reported line 86)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_report.py (reported line 88)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 34)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 319)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 322)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 325)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 330)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 34)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_scan.py (reported line 34)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/test_scan.py (reported line 34)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/test_scan.py (reported line 330)May include surrounding context.
python
self.assertIsInstance(result, str) def test_url_injection(self): result = scan.parse_repo("https://github.com/owner/repo; rm -rf /") self.assertIsInstance(result, str)

Static analysis

No suspicious patterns detected.