github-skill-manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.3

Overview

This skill’s purpose is coherent, but it can install, update, and delete persistent agent skills from mutable GitHub sources without enough validation or review controls.

Review this skill before installing. Use it only with trusted repositories, prefer immutable commit references, avoid unattended broad updates, and confirm exact skill names and paths before update or uninstall actions because it modifies persistent agent skills.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:50

Finding

Unverified Installation and Update of Mutable Remote Skill Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-63 and 69-88
Vulnerability Type: Remote supply-chain content retrieval without integrity verification
Risk Level: High

Vulnerable Code Snippet

bash

gh api "repos/{owner}/{repo}/tarball/{branch}" > archive.tar.gz
# Extract the archive and copy {path} to skills/{skill-name}/

bash

gh api "repos/{owner}/{repo}/contents/{path}?ref={branch}" --jq '.sha'

The surrounding installation and update instructions direct the agent to:

text

1. Parse owner, repo, branch, and path from the source.
2. Download the repository archive and extract the target directory.
3. Save the skill under skills/{skill-name}/.
4. Record the source and commit in REGISTRY.yaml.
5. During updates, download the source again and replace the installed skill.

Technical Analysis

The manager accepts GitHub repository coordinates and downloads skill content from a branch, with main used by default. A branch is a mutable reference: its effective contents can change after the source was initially reviewed or installed.

The documented process does not require the manager to:

• Resolve the branch to an immutable commit before downloading.
• Download the archive using that immutable commit.
• Verify a cryptographic checksum or signature.
• Restrict installation to approved repository owners.
• Review or quarantine the downloaded skill before placing it in the active skills/ directory.
• Confirm that the archive and separately queried content SHA correspond to the same trusted artifact.

Recording a commit value in REGISTRY.yaml provides provenance metadata but does not authenticate the downloaded archive before activation. In addition, the update process intentionally replaces an existing skill with newly retrieved remote content. A repository owner or attacker who compromises the repository can therefore change the effective skill payload ...[truncated 1534 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve the requested branch to a full immutable commit SHA before downloading any content.
2. Download the archive by that exact commit SHA rather than by a mutable branch name.
3. Verify that the downloaded artifact matches the resolved commit and, where available, verify a trusted signature or pinned cryptographic checksum.
4. Require explicit user confirmation for new repository owners and maintain an allowlist for unattended updates.
5. Extract downloads into a newly created private staging directory and inspect the skill manifest, instructions, scripts, symlinks, and executable files before activation.
6. Keep the staged artifact outside the active skill search path until all validation succeeds.
7. Perform replacement atomically only after verification. If any step fails, preserve the current installed version and registry entry.
8. Record the full verified commit SHA and artifact digest in REGISTRY.yaml.
9. For updates, display the old and new immutable commits and require review or approval when executable files or security-sensitive instructions change.
10. Consider enforcing signed commits or releases for trusted publishers and rejecting unsigned updates where policy requires it.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:26

Finding

Insufficient Validation of Path-Derived Filesystem Destinations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-35 and 100-105
Vulnerability Type: Path traversal and unsafe filesystem operation design
Risk Level: High

Vulnerable Code Snippet

text

The skill name is taken from the final directory segment of path.

Installation destination:
skills/{skill-name}/

Uninstallation:
1. Confirm the skill name.
2. Delete skills/{skill-name}/.
3. Remove the corresponding entry from REGISTRY.yaml.

Technical Analysis

The instructions derive skill-name from a repository path and later use that value to construct installation, replacement, and deletion destinations. They do not define validation or canonicalization requirements for either value.

In particular, the documented workflow does not explicitly require rejection of:

• Empty names or reserved path segments such as . and ...
• Absolute paths.
• Platform-specific path separators.
• Names that normalize outside the intended skills root.
• Symbolic links within an existing destination or extracted archive.
• Archive entries containing traversal paths.
• Duplicate or ambiguous names that resolve to the same canonical destination.

Consequently, an implementation that follows the prose literally may construct a destination outside the intended skills/ directory. The risk is especially significant during updates and uninstallation because those operations replace or recursively delete an existing path.

Safe archive extraction is also not specified. Even when the selected destination is valid, a malicious archive can contain entries whose names escape the extraction directory or symlinks that redirect subsequent writes.

Attack Path

1. An attacker supplies a crafted repository path, skill identifier, or repository archive containing traversal components or malicious symbolic links.
2. The manager derives a filesystem name or extraction destination without strict validation an ...[truncated 1220 chars]

Remediation

View remediation

Remediation Suggestions

1. Require skill names to match a strict allowlist pattern, such as ^[A-Za-z0-9][A-Za-z0-9._-]*$.
2. Explicitly reject empty names, ., .., absolute paths, path separators, control characters, and platform-specific reserved names.
3. Canonicalize the skills root and destination, then verify that the destination remains a direct child of the canonical skills root.
4. Do not construct deletion targets directly from untrusted user input. Resolve the target through a validated registry entry and repeat the containment check immediately before deletion.
5. Reject symlinked skill roots and avoid following symlinks during copy, replacement, and recursive deletion.
6. Extract archives into a private staging directory using an extraction routine that validates every entry.
7. Reject archive entries that are absolute, contain traversal components, escape the staging root after normalization, or create unsafe symbolic or hard links.
8. Copy only the validated repository subdirectory into a newly created destination.
9. Use atomic directory replacement for updates, preserving the old directory until the staged replacement passes all checks.
10. Add tests covering traversal paths, absolute paths, mixed separators, symlink escapes, malicious archive entries, reserved names, and deletion containment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L003 使用中文描述技能何时应被优先调用，相当于以自然语言规定了交互语言环境，但文档中没有提供语言/locale 选择，也没有说明该技能仅适用于中文用户或特定区域。根据语言/locale 政策，这属于未经用户选择的语言强制。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to delete skills/{skill-name}/ and modify REGISTRY.yaml during uninstall without requiring explicit user confirmation. Because these are destructive local file operations, an ambiguous request, misparsed skill name, or prompt injection routed through this skill could cause unintended deletion of installed content and loss of registry state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.