Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it asks users to enable broad, persistent GitHub automation from an unpinned external repository without enough scoping or warnings.
Review the external repository and its workflows before use, pin to a known commit, restrict allowed GitHub Actions, set least-privilege workflow permissions, avoid exposing production secrets, and test in a non-production repository before enabling auto-replies or Pages deployment.
The subsequent setup instruction directs the user to enable:
text
"Allow all actions"
Technical Analysis
The Skill instructs users to clone a mutable external GitHub repository and then enable unrestricted GitHub Actions. No immutable commit, release digest, or verified artifact is specified. Consequently, the repository contents executed by a user may differ from those available when this Skill was audited.
The local package contains only SKILL.md; the advertised workflows and monitoring scripts are not included. Their implementation, requested permissions, third-party Action references, secret handling, and executed commands therefore cannot be reviewed from the submitted artifact.
This creates a remote payload execution channel: maintainers, compromised maintainer accounts, or attackers who gain control of the referenced repository could modify its workflows after publication. Enabling all Actions may also permit workflows to invoke unpinned third-party Actions, expanding the supply-chain attack surface.
Attack Path
A user follows the Skill and clones https://github.com/sendwealth/claw-intelligence.
The user enables the GitHub setting labeled "Allow all actions".
An attacker compromises the remote repository, a maintainer account, or an unpinned Action used by its workflows.
The attacker adds or modifies a workflow to execute attacker-controlled commands.
The workflow is triggered by an event such as an issue, push, schedule, or manual dispatch.
The malicious commands execute in the GitHub Actions runner with the workflow's configured GITHUB_TOKEN permissions and any secrets made available to that workflow.
Impact
...[truncated 830 chars]
Remediation
View remediation
Remediation Suggestions
Include all required workflows, scripts, templates, and configuration files directly in the reviewed Skill package.
If external retrieval is unavoidable, pin the repository to a reviewed immutable commit and verify the expected commit identifier before use.
Pin every third-party GitHub Action to a full commit SHA rather than a mutable branch or version tag.
Replace "Allow all actions" with an allowlist containing only reviewed Actions from explicitly trusted sources.
Define least-privilege workflow permissions, defaulting to:
yaml
permissions:
contents: read
Grant write permissions only to individual jobs that demonstrably require them.
Do not expose production, deployment, or repository secrets to workflows triggered by untrusted events.
Require manual review before enabling workflows or accepting workflow changes.
Use protected branches, required code review, environment approvals, and CODEOWNERS protection for workflow files.
Document the exact reviewed repository commit, required permissions, triggers, external Actions, and secret requirements.
Add integrity and provenance controls, such as release checksums, signed commits or tags, and artifact attestations.
The skill instructs users to enable broad GitHub Actions automation and public deployment features, but it does not warn about the security and operational risks of allowing all actions, automated issue replies, hourly checks, and Pages deployment. In this context, the omission is risky because the skill is explicitly designed for fully automated company operations, which increases the chance of unintended repository changes, abusive automation, or exposure of public-facing content.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
The skill content is presented entirely in Chinese, including the title, instructions, and usage guidance, with no indication that users may choose another language or that the skill is intended only for a Chinese-language context. This can violate language/locale policy when a specific language is imposed without opt-in.
