ClawHub
Back to skill

Security audit

PR Review Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill automates GitHub PR follow-up using already-authorized repository access, with its branch and PR actions disclosed and scoped.

Install only when you want an agent to actively manage a specific GitHub PR. Scope GitHub credentials to the target repository and branch where possible, and be aware that the skill can push commits, resolve review threads, create a PR, and rewrite the PR branch history when that matches the requested workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
83% confidence
Finding

The skill explicitly endorses history rewriting and includes git push --force-with-lease, which can modify published branch state. Although constrained to the active PR head branch and safer than plain --force, this still creates risk of accidental data loss, overwrite of collaborator work, or misuse if branch/remote identification is wrong.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

gh run watch --repo <owner/repo> --exit-status --interval 30 gh run rerun --repo <owner/repo> git commit --amend --no-edit git push --force-with-lease

text

## Reporting Back

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
## Access And Safety

- Use only GitHub access already provided by the host environment, such as the configured `github` MCP server, `gh` CLI auth, or the local git credential helper. Do not ask the user to paste tokens into chat, and do not read secret files.
- Before any edit, push, PR mutation, or review-thread resolution, verify that the repository, PR, active branch, and intended history strategy match the user's request.
- Treat missing GitHub permissions, missing git remote auth, or an ambiguous target repository/branch as a real blocker and report it instead of guessing.
- Limit history rewrites and force pushes to the active PR head branch. Never force-push a default, base, protected, or unrelated branch.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
- State what was fixed, what was validated, and what the current PR/CI/review state is.
- Include exact PR numbers, run ids, and commit SHAs when they matter.
- If you are still in the waiting loop, say that explicitly instead of sounding finished.
- During the loop, give status updates without asking whether to continue unless a real blocker requires user intervention.

Static analysis

No suspicious patterns detected.