Security audit

Gitea Actions

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it handles a powerful Gitea token in ways that could expose it if configured insecurely.

Install only if you control the Gitea endpoint and can use a least-privilege token. Configure GITEA_URL with HTTPS, avoid broad account tokens, and consider rotating any token previously used with the documented HTTP-style configuration or in environments where process arguments are logged or visible.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:7
Finding: Gitea API Token Can Be Transmitted over Plaintext HTTP
Content: View full analysis
` to the endpoint without TLS. 4. An attacker with access to the network path captures the request and extracts the token. 5. The attacker reuses the token directly against the Gitea API. 6. The attacker obtains whatever repository and workflow ...[truncated 741 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:39
Finding: Gitea API Token Is Exposed in the curl Process Argument Vector
Content: View full analysis
{ const p = spawn("curl", args, { env: process.env }); ``` `index.js:38-40`: ```js "-X", "POST", "-H", `Authorization: token ${GITEA_TOKEN}`, "-H", "Content-Type: application/json", ``` `index.js:56`: ```js const result = await curl(["-sS", "-H", `Authorization: token ${GITEA_TOKEN}`, url]); ``` `index.js:63`: ```js const result = await curl(["-sS", "-H", `Authorization: token ${GITEA_TOKEN}`, url]); ``` ### Technical Analysis The skill interpolates `GITEA_TOKEN` into a command-line argument passed to the spawned `curl` process. Although `spawn` is used without a shell and therefore avoids shell metacharacter interpretation, the secret remains present in the child process's argument vector. Depending on the operating system, process-isolation policy, container configuration, and monitoring environment, command-line arguments can be visible through process-listing utilities, process telemetry, audit systems, or interfaces such as `/proc//cmdline`. The process only needs to be observed while the request is active. This issue is credential exposure rather than command injection: the array-based `spawn` invocation does not itself provide a shell injection path. ### Attack Path 1. A legitimate caller invokes any supported action. 2. The skill starts `curl` with the complete authorization header in its argument vector. 3. A local user, colocated process, container observer, or monitoring agent with sufficient process-inspection access observes the `curl` process. 4. The observer reads the command-line arguments and extracts the Gitea token. 5. The observer reuses the token against the configured Gitea instance. 6. The observer gains the repo ...[truncated 680 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code launches an external subprocess using spawn("curl", ...), which is a safety-relevant operation for code files. While there are internal comments, there is no confirmation prompt, user-facing log/print, or visible disclosure in this file warning that the skill executes shell-adjacent external commands.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill performs authenticated network operations against a Gitea instance using a token from environment variables, but no manifest or user-visible purpose is provided to justify that capability. This creates an unnecessary trust gap: a caller may trigger repository workflow dispatches or inspect workflow runs without clear disclosure, increasing the risk of unauthorized CI/CD actions or information exposure if the skill is installed in a broader agent context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill sends an authorization token in outbound requests to a URL derived from GITEA_URL without any user-facing disclosure or destination validation. If the environment variable is misconfigured or attacker-controlled, the token could be transmitted to an unintended host, enabling repository compromise or abuse of CI/CD infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code reads GITEA_URL and GITEA_TOKEN from environment variables, including a credential-like token. Access to sensitive environment variables is listed as a warning-worthy operation for code files, but there is no user-facing notice or documentation in this file describing that dependency.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:11