Github App Authentication

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:00 PM UTC
• Version: 0.1.5

Overview

The skill is coherent for GitHub App authentication, but it asks users to install and update a mutable external credential-handling tool that can modify local GitHub authentication.

Review and trust the ghapp source and release process before installing. Use a GitHub App limited to the minimum repositories and permissions, protect the private key, avoid running ghapp update automatically, and prefer a reviewed or pinned version in CI or shared environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Credential-Handling Dependency and Mutable Self-Update Channel<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 24 **Vulnerability Type**: Unpinned third-party dependency and mutable update channel **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🔑","requires":{"bins":["ghapp"]},"install":[{"id":"brew","kind":"brew","formula":"operator-kit/tap/ghapp","bins":["ghapp"],"label":"Install ghapp (brew)"}]}} ``` ```text - `ghapp update` — self-update to latest release ``` ### Technical Analysis The skill directs users to install `ghapp` from the third-party Homebrew tap `operator-kit/tap/ghapp` without specifying an immutable version, formula revision, source commit, checksum, or signature-verification requirement. It also documents a self-update operation that installs the latest release, whose contents may change after this skill has been reviewed. This dependency is security-sensitive because the documented workflow gives it access to the path of a GitHub App private key, permits it to generate and cache installation tokens, and allows it to modify Git and GitHub CLI authentication behavior. The dependency implementation is not included in the audited project, so its handling of credentials and updates cannot be verified from the available source. This does not prove that the current external package is malicious. The vulnerability is the absence of controls ensuring that future installations and updates use the same reviewed artifact. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, release account, artifact-hosting infrastructure, or self-update distribution channel. 2. The attacker publishes a modified `ghapp` formula or release under the expected package identity. 3. A user or automation installs `operator-kit/tap/ghapp` or executes `ghapp update`. 4. The substituted binary executes with the privileges of the invoking local user. 5. During setup or authentication, the binary receives or reads the configured GitHub App private-ke ...[truncated 958 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific audited release rather than implicitly installing the latest formula. 2. Pin the Homebrew tap or formula to an immutable commit or revision where the installation system permits it. 3. Publish and verify cryptographic checksums or signatures for release artifacts before execution. 4. Disable or discourage automatic self-updates in security-sensitive and automated environments. Route upgrades through a reviewed, version-controlled dependency update process. 5. Document the exact source repository, release version, artifact digest, and verification procedure expected by the skill. 6. Restrict the GitHub App to the minimum required repositories and permissions, avoiding organization-wide installation unless necessary. 7. Store the private key with restrictive filesystem permissions and isolate the tool in a dedicated execution environment where feasible. 8. Review the external dependency's source and update implementation before deployment, with particular attention to private-key handling, token storage, shell integration, path shims, and release verification. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Self-Modification

High

• Category: Rogue Agent

Content

- `ghapp auth status` — check auth health
- `ghapp auth reset [--remove-key]` — undo all auth config
- `ghapp config set`, `ghapp config get [key]`, `ghapp config path` — manage config
- `ghapp update` — self-update to latest release
- `ghapp version` — print version

gh auth modes (passed to `auth configure`)

• Confidence: 96% confidence
• Finding: The skill advertises a `ghapp update` self-update command, which causes the installed tool to modify itself by pulling code or binaries from an external release source. In an agent context, this is dangerous because it enables unreviewed code changes and supply-chain risk, especially if an automated workflow invokes update without pinning versions or verifying integrity.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This markdown file describes a skill that configures GitHub authentication and handles installation tokens, but the notes only mention token caching and config storage as factual behavior, not as a user-facing warning about credential-sensitive local state. Because the skill affects authentication material and writes config under the user's home directory, an explicit warning would better disclose privacy and system-impact implications.