T08 · Insecure Dependencies
Warning
- Location
SKILL.md:5- Finding
Unpinned Credential-Handling Dependency and Mutable Self-Update Channel
- Content
View full analysis
- Remediation
View remediation
Security audit
Github App Authentication
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for GitHub App authentication, but it asks users to install and update a mutable external credential-handling tool that can modify local GitHub authentication.
Review and trust the ghapp source and release process before installing. Use a GitHub App limited to the minimum repositories and permissions, protect the private key, avoid running ghapp update automatically, and prefer a reviewed or pinned version in CI or shared environments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The skill advertises a
ghapp updateself-update command, which causes the installed tool to modify itself by pulling code or binaries from an external release source. In an agent context, this is dangerous because it enables unreviewed code changes and supply-chain risk, especially if an automated workflow invokes update without pinning versions or verifying integrity.- Content
md - `ghapp auth status` — check auth health - `ghapp auth reset [--remove-key]` — undo all auth config - `ghapp config set`, `ghapp config get [key]`, `ghapp config path` — manage config - `ghapp update` — self-update to latest release - `ghapp version` — print version gh auth modes (passed to `auth configure`)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file describes a skill that configures GitHub authentication and handles installation tokens, but the notes only mention token caching and config storage as factual behavior, not as a user-facing warning about credential-sensitive local state. Because the skill affects authentication material and writes config under the user's home directory, an explicit warning would better disclose privacy and system-impact implications.
- Content