pr-pilot

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent pull-request workflow helper, but it gives broad repository mutation guidance and includes unsafe GitHub token handling instructions that users should review before installing.

Install only if you are comfortable with a skill guiding git pushes, PR creation, review comments, and PR tracking. Authenticate GitHub CLI yourself with gh auth login or a secure secret manager; do not paste tokens into chat or run literal export GH_TOKEN=<token> commands. Use fine-grained, short-lived tokens if a token is unavoidable, and replace the fixed /tmp/pr_body.md pattern with a secure temporary file or cleanup step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:19
• Finding: Unsafe Collection and Handling of GitHub Access Tokens## Vulnerability Details **File Location**: `SKILL.md`, lines 19-26 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: High **Vulnerable Code:** ```markdown GitHub CLI must be authenticated — PR creation, review monitoring, and commenting all require it: ```bash gh auth status # Must show "Logged in" ``` If not configured, ask the user to provide: 1. **GitHub username** — used for `--head {username}:{branch}` and PR search 2. **GitHub token** — run `gh auth login` or set `export GH_TOKEN=&lt;token&gt;` Token is required for: creating PRs, posting comments, checking review status, pushing iterations. ``` ### Technical Analysis The Skill explicitly instructs the agent to ask the user to provide a GitHub token. A personal access token is an authentication secret and should not be transmitted through an agent conversation. Tokens supplied through chat can be retained in conversation history, API request records, telemetry, debugging traces, or other logs. The suggested `export GH_TOKEN=&lt;token&gt;` pattern also encourages inserting a literal secret into shell input. Depending on how the command is executed, the token may be retained in shell history, terminal logs, process instrumentation, or agent tool-call records. The Skill does not require secure input, limit token permissions, recommend expiration, or prevent the agent from receiving the token directly. ### Attack Path 1. GitHub CLI is not authenticated when the Skill is invoked. 2. Following the Skill, the agent asks the user to provide a GitHub token. 3. The user enters the token into the conversation or a literal shell command. 4. The credential is retained in chat history, API logs, shell history, telemetry, or execution traces. 5. An attacker or unauthorized operator with access to one of those records extracts the token. 6. The attacker authenticates to GitHub and performs any operations permitted by the token's scopes until t ...[truncated 503 chars]
• Remediation: ## Remediation Suggestions - Never ask users to disclose GitHub tokens to the agent or place tokens in conversation content. - Instruct users to authenticate independently using `gh auth login`, preferably through GitHub's browser or device authorization flow. - Use `gh auth status` only to verify that authentication has already been configured. - If non-interactive authentication is unavoidable, retrieve the credential from an approved secret manager without printing it or exposing it to the agent. - Use short-lived, repository-scoped, fine-grained tokens with only the permissions required for the specific operation. - Avoid literal secrets in shell commands. Disable shell history where appropriate and ensure diagnostic output cannot print authentication variables. - Document token rotation and immediate revocation procedures for suspected exposure. - Replace the affected instructions with wording such as: ```markdown If GitHub CLI is not authenticated, ask the user to run `gh auth login` independently. Never request, display, or store the user's access token. After authentication, verify the session with `gh auth status`. ```

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:110
• Finding: Predictable Shared Temporary File Used for Pull Request Content## Vulnerability Details **File Location**: `SKILL.md`, lines 110-123 **Vulnerability Type**: Insecure temporary-file creation **Risk Level**: Medium **Vulnerable Code:** ```bash # Save description to a temp file cat &gt; /tmp/pr_body.md &lt;&lt; 'EOF' {pr description} EOF # Create PR gh pr create \ --repo {owner}/{repo} \ --head {username}:{branch} \ --base {default-branch} \ --title "{type}({scope}): {description}" \ --body-file /tmp/pr_body.md ``` ### Technical Analysis The Skill writes pull-request content to the fixed path `/tmp/pr_body.md`. On multi-user systems, `/tmp` is normally a shared directory. A predictable filename permits another local user to pre-create or monitor the path. The redirection does not securely create a new file and follows symbolic links. If an attacker creates `/tmp/pr_body.md` as a symbolic link before the command runs, the shell can truncate and overwrite the linked destination when the victim has permission to write it. The file's permissions also depend on the current `umask`; the Skill does not enforce owner-only access. Finally, the file is not removed after use, leaving PR content on disk. ### Attack Path 1. An attacker with local access predicts that the Skill will use `/tmp/pr_body.md`. 2. Before the Skill writes the file, the attacker creates that path as a symbolic link to a file writable by the victim, or monitors the path for creation. 3. The agent executes the documented `cat &gt; /tmp/pr_body.md` command. 4. In the symlink scenario, the shell follows the link and truncates or overwrites the target with the pull-request description. 5. In the disclosure scenario, permissive file permissions or subsequent access allow the attacker to read the PR description. 6. Because no cleanup is performed, the content remains available after `gh pr create` finishes. Exploitation requires local access to the same host and suitable filesystem permiss ...[truncated 690 chars]
• Remediation: ## Remediation Suggestions - Generate a unique temporary file atomically with `mktemp`. - Set `umask 077` before creation so only the current user can read or write the file. - Quote the generated path in every command. - Register a cleanup trap immediately after creation and remove the file when the command finishes or is interrupted. - Avoid storing sensitive information in the PR body when it is not required. - Use the following hardened pattern: ```bash umask 077 pr_body=$(mktemp "${TMPDIR:-/tmp}/pr_body.XXXXXX") || exit 1 trap 'rm -f "$pr_body"' EXIT HUP INT TERM cat &gt; "$pr_body" &lt;&lt; 'EOF' {pr description} EOF gh pr create \ --repo {owner}/{repo} \ --head {username}:{branch} \ --base {default-branch} \ --title "{type}({scope}): {description}" \ --body-file "$pr_body" ``` - Where supported, avoid an intermediate file entirely by securely passing the body through standard input or a CLI option that does not expose it in process arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description says to use the skill when 'submitting PRs to any repository, responding to code reviews, or managing multiple open PRs across projects,' which is extremely broad and lacks explicit trigger boundaries or exclusion conditions. In a markdown/manifest context, this can cause unintended activation because it describes a wide class of common engineering tasks without specifying narrower invocation phrases or contexts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly asks the user to provide a GitHub token and suggests exporting it, but it does not warn against pasting secrets into chat, storing them in logs, or exposing them through shell history/environment leakage. In an agent setting, this can normalize unsafe secret handling and increase the chance of credential disclosure or misuse across repositories.

Static analysis

No suspicious patterns detected.