Security audit

tag-release

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised GitHub tagging work, but it ships live-looking credentials and unrelated Feishu/Jenkins configuration that users should review before installing.

Install only after removing bundled credentials and rotating any exposed GitHub, Feishu, and Jenkins secrets. Use user-supplied least-privilege credentials, confirm the exact repositories before running, and make Release creation or backfill behavior explicit before execution.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs execution of a local Python script, reads configuration files, invokes git, and interacts with GitHub, yet it does not declare corresponding permissions. This creates a governance gap: reviewers and policy engines may underestimate its ability to perform shell execution, file access, and networked write operations such as pushing tags and creating releases.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a tag-creation workflow, but the content expands behavior to additional GitHub operations: creating releases, querying PR metadata, reading release state, and backfilling releases for existing tags. This mismatch is dangerous because users or enforcement systems may authorize a narrower action while the skill performs broader remote API actions and consumes a privileged token beyond the minimally expected scope.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The config for a skill described as only creating and pushing release tags includes additional operational capabilities such as Feishu notifications, wiki integration, and Jenkins automation. This expands the skill's effective privilege and attack surface beyond its stated purpose, creating unnecessary opportunities for misuse if the skill or its execution path is compromised.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file hard-codes live credentials and endpoints for Feishu and Jenkins in a skill whose declared purpose is only release tagging. Embedded secrets can be extracted and abused to send messages, access Feishu resources, or trigger CI/CD systems, and the mismatch in purpose makes their presence especially suspicious and dangerous.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill description says it creates and pushes release tags, but the implementation also creates GitHub Releases via the API. This expands the skill's side effects beyond the declared behavior, which can surprise users, publish metadata externally, and violate least-privilege expectations for an automation skill.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The module docstring claims the allowlist only permits querying branch commits, PRs, and creating/querying tags, yet the actual allowlists and code also permit release reads and writes. This documentation-to-code mismatch is dangerous because reviewers and users may trust stated restrictions while the script performs broader write operations against GitHub.

Static analysis

No suspicious patterns detected.