Security audit

github-autosetup

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly coherent GitHub automation, but it installs persistent auto-push behavior that can automatically stage, commit, and push repository contents without enough user control.

Install only if you intentionally want selected repositories to be pushed automatically and you are comfortable with a scheduled task that may also auto-stage, auto-commit, and push local changes. Review the target repo list carefully, ensure secrets and private files are excluded before enabling it, and plan how to remove the hooks and scheduled task if you change your mind.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill’s declared behavior understates several materially sensitive actions: creating persistence via Windows scheduled tasks, modifying repository hooks/scripts, and apparently auto-committing changes. In a skill that operates on local repositories and GitHub credentials, undisclosed automation can cause unintended code publication, persistent background activity, and loss of user control over what is committed or pushed.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The script contradicts its own safety claim by reading and printing local Git identity, SSH public key paths, and filtered GitHub CLI authentication status. Even if it avoids printing full secrets, this still exposes sensitive environment metadata to the caller, logs, transcripts, or higher-level agents, which can aid account enumeration, social engineering, or follow-on credential targeting.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises post-commit automatic pushing and a scheduled-task fallback, but does not prominently warn that setup will cause ongoing outbound network traffic after installation. In an agent-driven workflow, this can surprise users, leak repository contents earlier than intended, and reduce meaningful consent around continuous exfiltration of local changes to a remote service.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad enough to match common requests like '配置 git' or '推送仓库', which could cause the skill to activate in contexts where the user only wanted simple Git help. Because the skill performs high-impact actions such as authentication changes, hook installation, and scheduled-task persistence, over-broad invocation increases the risk of accidental execution.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script is explicitly designed to install automatic commit/push behavior and a recurring scheduler, but the usage and header text do not prominently warn that repository contents may be transmitted in the background after future commits. In the context of a GitHub auto-setup skill, this is more dangerous because users may invoke it for convenience and unintentionally enable persistent data egress from local repositories.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script writes post-commit hooks directly into user repositories, changing their behavior so that future commits trigger network pushes without per-repository confirmation. This is risky because hooks are persistent and can surprise users, especially when run across multiple repositories passed as arguments.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The generated autopush script stages all changes, creates commits automatically, and a scheduled task repeatedly runs it in the background. This creates a persistent mechanism for ongoing data transmission and broad file capture, which is especially sensitive in a GitHub automation skill because local secrets, unintended files, or work-in-progress content may be committed and pushed without timely user awareness.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.