issue-hunter

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward GitHub issue-triage helper that uses authenticated GitHub read commands and creates a local analysis report.

Install only if you are comfortable letting the agent use your authenticated GitHub CLI for read-oriented issue and PR queries. Use a least-privileged GitHub token where possible, avoid pasting broad long-lived tokens into chat, and ask the agent to check before overwriting issue-analysis.md if that file may already matter in your workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill instructs the agent to write `{workspace}/issue-analysis.md` but does not require any user notice, confirmation, or overwrite safeguards. This can cause unintended modification or replacement of an existing file in the workspace, which is especially relevant because the skill is designed to run against arbitrary repositories and workspaces where that path may already be meaningful.

VirusTotal

65/65 vendors flagged this skill as clean.