T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Unnecessary Solicitation of Over-Privileged GitHub Credentials
- Content
View full analysis
` Without auth, `gh` API calls will hit rate limits quickly and private repo data won't be accessible. ``` ### Technical Analysis The Skill makes GitHub authentication mandatory and instructs the agent to ask the user to provide a GitHub token. However, the declared repository-discovery workflow primarily uses public GitHub metadata and does not inherently require access to private repositories. The instructions do not: - Restrict the token to minimum necessary permissions. - Distinguish public-repository research from explicitly requested private-repository analysis. - Prohibit users from pasting credentials into the conversation. - Require an interactive authentication mechanism that keeps the token outside the agent context. - Explain that unauthenticated access can still be used within GitHub's public API rate limits. Consequently, a user may provide a broadly scoped personal access token even when the task only requires public information. Supplying a token through conversation text or an environment-variable command can expose it to agent context, transcripts, logs, shell history, or other tools available during execution. The project does not contain instructions to exfiltrate or deliberately misuse the token. The security issue is the unnecessary expansion of the agent's privileges and the unsafe credential-handling guidance. ### Attack Path 1. A user invokes the Skill to rank publicly accessible GitHub repositories. 2. The Skill checks `gh au ...[truncated 1526 chars]- Remediation
View remediation
` because environment variables may be inherited by subprocesses or exposed through logs and debugging tools. 5. **Enforce least privilege** - Document the minimum GitHub permissions needed for each workflow. - For public repository analysis, use a fine-grained token limited to public-resource read access only if authentication is required. - Do not request private-repository, organization-administration, workflow, package, or write permissions unless a user explicitly requests functionality that requires them. 6. **Avoid unnecessary identity collection** - Do not separately solicit the GitHub username when it can be obtained from an already authenticated session, for example with `gh api user --jq .login`. 7. **Add credential-handling safeguards** - Instruct the agent never to print, persist, summarize, or include credentials in generated rankin ...[truncated 151 chars]