opensource-skill-to-github

• Outcome: Review
• Latest audit: Jul 30, 2026 · 10:32 AM UTC
• Version: 1.0.16

Overview

This is a coherent publishing helper, but it needs Review because it can publish local files externally, use stored/session tokens, execute a configured token command, and delete files in the fork from custom patterns.

Install only if you are comfortable with a local shell-based publishing workflow. Before running publish steps, inspect the fork file list, avoid plaintext tokens in profile.env, prefer gh auth token or an OS keychain, and do not use .osg-exclude patterns unless you understand exactly what they will delete. Treat skillhub.cn publishing as a separate external upload destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly describes shell execution and file access, but it does not declare corresponding permissions. This creates a trust and review gap: operators may approve or run the skill without realizing it can read local files and invoke commands that affect the system or repositories.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior understates several sensitive capabilities: persistent profile storage, optional non-interactive execution, token retrieval via an arbitrary command, temporary file creation, and publishing to an additional platform. This mismatch is dangerous because users may consent to a narrower workflow while the skill performs broader actions involving credentials, persistence, and external publication.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The playbook instructs writing post-release notes into persistent memory files, which expands the skill's operational scope beyond the stated publication workflow and creates a durable storage channel. In a skill that handles internal-to-public transformations and token-related workflows, persistent memory increases the chance that sensitive context, internal identifiers, or operational details are retained longer than intended.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The token hygiene section is internally contradictory: it says tokens must never be written to file/git/memory, then recommends a token storage file path. That contradiction can normalize unsafe credential persistence and lead operators or downstream automation to save reusable secrets on disk, where they may be exfiltrated, backed up, or accidentally committed despite gitignore protections.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script explicitly stores identity data in a persistent per-user profile under the home directory and advertises that it survives agent/workspace changes. Even though the stored fields are not highly sensitive by themselves, this exceeds the immediate one-run publishing need and creates cross-context persistence that can expose personal data more broadly than necessary.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Usage: SKILLHUB_CN_TOKEN=skh_xxx ./skillhub_cn_publish.sh <fork-abs-path>
#
# 协议（2026-07-13 实测）：
#   POST https://api.skillhub.cn/api/v1/community/skills/publish
#   Content-Type: multipart/form-data ; Authorization: Bearer skh_xxx
#   field "payload" (JSON): slug / name / displayName(必填) / summary / description / version
#   field "files" (repeated): 每个源码文件（白名单外的文件会被平台拒收）

• Confidence: 91% confidence
• Finding: The script transmits local skill files and metadata to an external third-party service, which is a real data egress action. In this skill context, that behavior is expected for publishing, but it is still security-relevant because a user may accidentally upload sensitive source content, embedded secrets, or internal-only files if sanitization is incomplete.

Credential Access

High

• Category: Privilege Escalation

Content

### 9.1 用户操作（必须用户做，AI 不能自动）

1. 浏览器登录 GitHub → 新建 repo `<repo-name>`（**勾 main 分支**，不勾 README/LICENSE/gitignore）
2. token 可用已配置来源（推荐 `OSG_GITHUB_TOKEN_CMD` / `gh auth token`）；若没有配置，再生成 Personal Access Token（PAT）并只通过环境变量传一次

### 9.2 Token 配置与卫生（铁律）

• Confidence: 89% confidence
• Finding: The skill supports obtaining GitHub credentials from environment variables and from `OSG_GITHUB_TOKEN_CMD`, which is an arbitrary shell command whose output is treated as a token. Executing a command from profile/env materially increases risk of credential theft or command injection if that configuration is tampered with, especially because this skill already has shell execution capability.

Credential Access

High

• Category: Privilege Escalation

Content

# setup_profile.sh — 首次引导：交互式收集开源身份 + 写入持久化 profile
#
# 写入位置（XDG 兼容）：
#   ${XDG_CONFIG_HOME:-$HOME/.config}/opensource-skill-to-github/profile.env
#
# 跨 agent 工作：profile 在用户 $HOME 下，不在 skill 目录、不在 workspace；
# 重装 skill / 切 agent / 换 workspace 都不丢；权限 600 不可被其他用户读。

• Confidence: 76% confidence
• Finding: The profile is stored as a .env-style file in the user's config directory and later sourced by shell helpers, and the comments explicitly allow optional token storage/configuration alongside identity data. Even with chmod 600, persistent shell-readable config files increase the blast radius of accidental disclosure, backups, or later misuse by other scripts/processes running as the same user.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

esac
      n="$(find "$dir" -name "$pat" 2>/dev/null | wc -l | tr -d ' ')"
      [[ "$n" -gt 0 ]] && removed=$((removed + n))
      find "$dir" -name "$pat" -exec rm -rf {} + 2>/dev/null || true
    done < "$dir/.osg-exclude"
  fi

• Confidence: 87% confidence
• Finding: Here the deletion target is driven by patterns read from `.osg-exclude`, and the script executes `find "$dir" -name "$pat" -exec rm -rf {} +` on every accepted entry. Although some broad patterns are blocked, an attacker-controlled or unsafe `.osg-exclude` can still specify destructive names such as `.git`, `node_modules`, `dist`, or other project-critical directories, causing recursive deletion of arbitrary matching paths anywhere under the forked tree and potentially stripping security-relevant metadata or sabotaging the published artifact.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/git_init.sh:102