Security audit

Prompt Request Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed GitHub automation pipeline, but it gives untrusted webhook content enough control to change, push, and potentially merge repository code without strong safeguards.

Only install this in a tightly controlled environment after adding safeguards: trusted repository and actor allowlists, sandboxed disposable runners, scoped short-lived GitHub credentials, safe argument handling instead of interpolated shell commands, pinned dependencies, mandatory CI, and human approval before pushing or merging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: templates/messageTemplate.txt:10
Finding: Untrusted GitHub content is treated as privileged agent instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/messageTemplate.txt:50
Finding: Issue-title interpolation permits shell command injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: templates/messageTemplate.txt:29
Finding: Unpinned npx package execution creates a supply-chain execution path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/messageTemplate.txt:43
Finding: Repository-defined tests are executed without an isolation boundary
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: templates/messageTemplate.txt:61
Finding: Weak authorization and CI conditions permit unsafe automatic merging
Content: View full analysis
' 6. AUTO-MERGE CHECK: If ALL of these are true, merge the PR automatically: a. The PR title contains '[auto]' OR the PR body contains 'auto-implement' OR the source branch starts with 'feature/issue-' b. Your review verdict is LGTM (no security issues, no bugs found) c. Run: gh pr checks {{pull_request.number}} --repo {{repository.full_name}} --json name,state | If the result is empty (no CI configured), treat this condition as PASSED. If checks exist, verify all states are SUCCESS or SKIPPED. d. Run: gh pr view {{pull_request.number}} --repo {{repository.full_name}} --json mergeable | check mergeable is MERGEABLE (no conflicts) If ALL conditions pass: gh pr merge {{pull_request.number}} --repo {{repository.full_name}} --squash --delete-branch If ANY condition fails: log why auto-merge was skipped (do NOT use message tool) 7. Log results (do NOT use message tool or react - deliver handles notifications automatically) ``` ### Technical Analysis The workflow uses PR title, body text, or source-branch naming as the signal that a pull request is authorized for automatic merging. These values may be controlled by a pull-request author and are not reliable authorization attributes. The workflow also treats an empty CI result as a successful check. The same AI agent performs the review, determines that its own result is LGTM, and executes the merge. This provides no independent reviewer, trusted-author requirement, mandatory test evidence, or explicit human approval. ### Attack Path 1. An attacker submits or causes the creation of a pull request using an accepted `[auto]` marker, `auto-imple ...[truncated 780 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template directs the agent to clone repositories, implement changes, commit, push, create PRs, and continue automation, but it does not present a clear user-facing warning or consent boundary for repository-modifying actions. This is dangerous because issue bodies and related GitHub content are untrusted input, yet they can drive real code changes in a live repository pipeline.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The template authorizes automatic merge when heuristic conditions pass, including cases where no CI is configured, and does so without an explicit safety warning or mandatory human approval gate. In this context, auto-merge materially increases the blast radius of any prompt-injection, logic error, weak review, or compromised dependency by allowing untrusted-triggered changes to land in the default branch with minimal friction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises a fully automated Issue-to-merge pipeline without prominently warning users that untrusted Issue content can trigger code changes, PR creation, auto-merge, and Issue closure. In this context, the absence of a strong warning materially increases the chance that users enable or invoke the workflow without understanding that externally supplied text can directly drive repository modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented hook configuration sets allowUnsafeExternalContent to true for GitHub webhook payloads, meaning externally supplied Issue, PR, comment, and check data can be injected into the agent's context. Because this same skill then implements code, pushes branches, creates PRs, and auto-merges, prompt injection or malicious repository/user content could steer the agent into unsafe code changes or workflow abuse.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
Title: [auto] Generate report with weather data Body: Read skills/weather/SKILL.md for API usage. ## Requirements ...

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a development automation pipeline triggered by GitHub Issues, handling implementation, testing, PR creation, review, and merge. This template instead defines a content-creation workflow for articles/blog posts, including SEO, tone, platform, and output file under content/, which is a materially different behavior domain than code-change automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The template restricts language to "<ja / en>" only, which imposes a locale/language constraint in natural language without stating that the user can choose other languages or that the limitation is justified. This can violate language-choice policy when the skill is used in broader contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The early-exit rule allows full processing for issue_comment with actionable content but does not define strict criteria for what is actionable. In this skill, ambiguous triggering is dangerous because comment-driven execution can lead the agent to implement code changes or respond to PR feedback based on loosely interpreted untrusted text from GitHub comments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The template executes npx tsx OMEGA_BRIDGE_PATH without pinning a specific package version or otherwise constraining resolution, which creates a supply-chain risk if package resolution is influenced by the environment or a compromised dependency source. In this skill, that risk is amplified because the command is part of an automated repo-modifying pipeline that can clone code, commit changes, create PRs, and participate in auto-merge flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file title and core descriptive text switch into Japanese for the main user-facing documentation, but there is no indication that the skill is intentionally Japan-specific or that users may choose another language. This can violate a language/locale policy when a specific language is imposed without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description says this template is for "article/content creation tasks," which is broad and does not define clear activation boundaries or exclusions. In a manifest-style file, this kind of generic scope can overlap with many common writing requests and may cause unintended invocation.
Content: No source excerpt is available for this finding.