T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-changelog.js:27- Finding
Shell Command Injection Through the Changelog --since Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
AutoGitHub
Security checks for vulnerabilities and agentic risk
Overview
This GitHub management skill is mostly aligned with its stated purpose, but it handles powerful GitHub tokens and CI/CD automation in ways that need careful review before installation.
Install only if you are comfortable giving this tool GitHub repository authority. Prefer a fine-grained PAT limited to specific repositories and permissions, do not pass secrets in shell history, protect or avoid the plaintext config file, review generated workflows before committing them, and fix the command-injection and mutable-action template issues before using it in CI/CD or production deployment workflows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
templates/github-actions/deploy-workflow.yml:34- Finding
GitHub Actions Shell Injection Through workflow_dispatch Version Input
- Content
View full analysis
> $GITHUB_OUTPUT elif [[ "${{ github.ref }}" == refs/tags/* ]]; then echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT else echo "version=$(git describe --tags --always)" >> $GITHUB_OUTPUT fi ``` ### Technical Analysis GitHub expression substitution occurs before the generated script is executed. The manually supplied `version` input is embedded directly into shell source code in two locations. An input containing quote characters and shell syntax can break out of the intended quoted value and modify the script executed by the runner. Quoting the expression as `"${{ ... }}"` does not make it safe because the untrusted value is inserted into the script before Bash parses the quotes. ### Attack Path 1. A user with permission to dispatch the workflow supplies a crafted `version` input. 2. GitHub substitutes that value directly into the `run` script. 3. The crafted value terminates or changes the intended shell expression. 4. Bash interprets the injected syntax as runner commands. 5. The commands execute within the `prepare` job's security context. ### Impact Assessment Exploitation provides command execution on the GitHub-hosted runner. The attacker could modify job outputs, inspect the checkout, make network requests, and access credentials available to the `prepare` job. Because `actions/checkout` uses persisted Git credentials by default, the effective repository impact also depends on the workflow token's configured default permissions. This does not automatically expose environment secrets assigned only to later deployment jobs, but poisoned output ...[truncated 63 chars]- Remediation
View remediation
&2 exit 1 fi printf 'version=%s\n' "$INPUT_VERSION" >> "$GITHUB_OUTPUT" elif [[ "$GITHUB_REF" == refs/tags/* ]]; then printf 'version=%s\n' "${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" else printf 'version=%s\n' "$(git describe --tags --always)" >> "$GITHUB_OUTPUT" fi ``` Also: 1. Declare restrictive workflow and job-level `permissions`. 2. Configure checkout with `persist-credentials: false` where pushes are unnecessary. 3. Restrict who may dispatch production workflows. 4. Require protected GitHub environments and reviewers for production. 5. Treat all event properties and manual inputs as untrusted data. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
github-cli.js:34- Finding
GitHub Personal Access Token Exposed Through Command-Line and Plaintext Storage
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
templates/github-actions/deploy-workflow.yml:147- Finding
Mutable Third-Party GitHub Actions Receive API and Webhook Secrets
- Content
View full analysis
- Remediation
View remediation
``` 2. Apply the same SHA-pinning requirement to Snyk, Gitleaks, Docker, release, checkout, setup, and artifact actions. 3. Use Dependabot or Renovate to propose reviewed SHA updates. 4. Declare explicit read-only permissions globally and grant additional rights only to the specific jobs that require them. 5. Isolate secret-bearing notification and scanning steps into minimal jobs. 6. Use protected GitHub environments for production credentials. 7. Rotate webhook and API credentials if an upstream action compromise is suspected. 8. Where practical, replace third-party notification actions with a small, audited script that sends only the required fields to an allowlisted endpoint. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-changelog.js:177- Finding
Arbitrary Writable File Overwrite Through the Changelog Output Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (38)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Requirements - **Node.js**: >= 14.0.0 - **GitHub**: A [Personal Access Token](https://github.com/settings/tokens) with `repo` scope (recommended) ## Installation
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Requirements - **Node.js**: >= 14.0.0 - **GitHub**: A [Personal Access Token](https://github.com/settings/tokens) with `repo` scope (recommended) ## Installation
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Requirements - **Node.js**: >= 14.0.0 - **GitHub**: A [Personal Access Token](https://github.com/settings/tokens) with `repo` scope (recommended) ## Installation
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Documenting a self-update command for the tool creates a supply-chain and self-modification risk if updates are fetched and applied without integrity verification, pinning, or operator review. In an agent skill context, self-updating behavior can change capabilities after trust has been established, potentially introducing malicious code or unsafe behavior later.
- Content
定期检查更新：
bash github self-update查看版本信息：
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
A documented self-update capability can introduce unreviewed code changes into the toolchain, creating a software supply-chain risk if update sources are compromised or insufficiently verified. In a privileged GitHub management skill, updating itself could alter behavior while retaining access to repositories, deployment workflows, and tokens.
- Content
定期检查更新：
bash github self-update查看版本信息：
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow states that production deployment requires manual approval, but the step only prints informational text and does not enforce any approval gate before continuing to the production deployment step. In a deployment pipeline, this can cause unauthorized or accidental production releases, especially because tag pushes will automatically route to production in this workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file describes safety-critical actions such as deploying to production and rolling back releases, which can affect system availability and user data. While the document includes token-security notes, it does not warn users in this section about the operational impact or recommend confirmation/review before running these commands.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The example configuration enables autoDeploy for the dev environment, which introduces autonomous operational actions that may execute without sufficient human review. In a GitHub management/deployment skill, this increases the chance of unintended code releases, especially if branch protections, tests, or approval gates are weak or misconfigured.
- Content
md "environments": { "dev": { "branch": "develop", "autoDeploy": true }, "prod": { "branch": "main",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file describes safety-critical operations such as deploying to production and rolling back releases, which can directly affect system integrity and availability. Although the document has general security notes, this section does not warn users about operational risk, required approvals, or potential service impact before running these commands.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md "environments": { "development": { "branch": "develop", "autoDeploy": true, "notifyOnFailure": true, "requiredChecks": ["test", "lint"] },
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
json "environments": { "development": { "branch": "develop", "autoDeploy": true, "notifyOnFailure": true, "requiredChecks": ["test", "lint"] },
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
json "environments": { "development": { "branch": "develop", "autoDeploy": true, "notifyOnFailure": true, "requiredChecks": ["test", "lint"] },
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
json "environments": { "development": { "branch": "develop", "autoDeploy": true, "notifyOnFailure": true, "requiredChecks": ["test", "lint"] },
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI accepts a GitHub token on the command line and persists it in plaintext to
.github-manager.jsonunder the current working directory. Command-line secrets can be exposed through shell history, process listings, logs, or CI traces, and the local config file may be accidentally committed or read by other local users/processes.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
json { "name": "github-manager-cli", "version": "1.0.0", "description": "A comprehensive GitHub repository management tool with code review, auto-deployment, changelog generation, CI/CD configuration, bug tracking, and project management automation", "main": "github-cli.js", "bin": { "github": "./github-cli.js"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's comments, CLI output, and date formatting are fixed to Chinese, including an explicit zh-CN locale at runtime. This forces a specific language/locale experience without any opt-in, selection mechanism, or documented regional limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code reads GitHub authentication data, including a token, from .github-manager.json and immediately uses it to authenticate API calls. Although the tool's purpose is code review, there is no nearby disclosure, prompt, or warning to the user in this file that sensitive credentials are being accessed from local storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script builds a shell command string for
git logand appendssinceTagdirectly before passing it toexecSync. BecausesinceTagcan come from the--sinceCLI argument, an attacker can inject shell metacharacters and execute arbitrary commands in the user's environment when the script runs.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file header, operational messages, and CLI usage are written in Chinese, which effectively forces a specific language for users. The policy allows fixed locale behavior only when user choice or a justified regional constraint is provided, neither of which appears here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The release body asserts that security scans passed even though the workflow contains no security scanning step. This creates false security attestations that can mislead operators, auditors, or downstream users into trusting artifacts that were never scanned.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown file documents actions that can modify repository state, including closing issues and creating CI/CD workflow files, but it does not explicitly warn users about reviewing targets or confirming changes before execution. For markdown files, user-facing warnings are expected when behaviors could affect user data or system integrity.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions and examples are presented only in Chinese, which effectively forces a specific language for users. The file does not mention that the skill is intended only for Chinese-speaking users or provide any language/locale opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill documentation includes commands to create repositories and later to create, assign, and close issues, all of which change remote GitHub resources. The description does not clearly warn that these actions will modify live repository/project data, which is relevant user-impact information for a markdown skill description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The GitHub client is initialized with a fixed time zone, which imposes a locale setting on all users of the tool. The file does not provide opt-in, configuration, or justification that this is intended only for a China-specific environment.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Using a caret range for @octokit/rest allows future compatible releases to be installed automatically, which can introduce supply-chain risk or unexpected vulnerable versions over time. In a GitHub management CLI that likely handles repository administration and API tokens, dependency drift is more sensitive than in a simple local utility.
- Content
json "author": "GitHub Manager Team", "license": "MIT", "dependencies": { "@octokit/rest": "^20.0.2", "commander": "^11.0.0", "chalk": "^4.1.2", "inquirer": "^8.2.6",