tag-release

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.0.1

Overview

This skill is a real multi-repository GitHub release/tag tool, but it ships plaintext service credentials and has unsafe broad-write defaults that require review before use.

Do not install or run this package as-is. The publisher should revoke and rotate the exposed credentials, replace assets/config.json with placeholders or runtime secret loading, remove unrelated Feishu/Jenkins secrets, and require explicit service selection or a separate confirmed bulk flag before any non-dry-run write.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/config.json:3

Finding

Plaintext credentials and unrelated secrets distributed with the Skill

Content

View full analysis

dict | list: token = str(cfg.get("github_token") or "").strip() if not token: raise RuntimeError("config.json 缺少 github_token") if any(ch in token for ch in ("…", "***")): raise RuntimeError("config.json 中 github_token 看起来已脱敏，无法查询 GitHub API") if org and repo: assert_allowed_github_get(path, org=org, repo=repo, commit=commit) url = "https://api.github.com{}".format(path) headers = { "Accept": "application/vnd.github+json", "Authorization": "Bearer {}".format(token), "X-GitHub-Api-Version": "2022-11-28", } resp = requests.get(url, headers=headers, params=params, timeout=20) ``` ### Technical Analysis The Skill package contains live-looking GitHub, Feishu, and Jenkins credentials in a plaintext JSON file. ...[truncated 2707 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tag_release.py:241

Finding

Omitting the service list causes organization-wide release writes

Content

View full analysis

list[RepoTarget]: repos_cfg = cfg.get("repos", {}) aliases_cfg = cfg.get("service_aliases", {}) normalized_repo_names = { normalize_service_key(repo_name): repo_name for repo_name in repos_cfg.keys() } normalized_aliases = { normalize_service_key(alias): target for alias, target in aliases_cfg.items() } if not names: selected = list(repos_cfg.keys()) ``` The command-line argument is optional, and resolved repositories are processed without an executable confirmation safeguard: ```python parser.add_argument( "--services", nargs="*", default=None, help="服务名列表；不传默认使用 config.json 里的全部 repos", ) ... repos = resolve_services(cfg, args.services, workspace_override=args.workspace) if not repos: print("[ERROR] 没有解析到任何有效服务", file=sys.stderr) return 1 target_date = parse_date(args.date) tag = args.tag or build_tag_name(target_date, prefix, base_year) tag_message = (args.message or "").strip() or None ... results: list[TagResult] = [] for repo in repos: print(f"[{repo.name}] processing...", end=" ") result = process_repo( cfg=cfg, repo=repo, branch=branch, tag=tag, tag_message=tag_message, dry_run=args.dry_run, ) ``` For a non-dry-run operation, each selected repository can receive both a tag and a release: ```python create_remote_annotated_tag(cfg, repo.github_repo, tag, target_commit, effective_tag_message) create_github_release(cfg, repo.github_repo, tag, branch, effective_tag_messag ...[truncated 2675 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A GitHub personal access token is embedded directly in the configuration file, exposing live credential material to anyone who can read the skill. An exposed token can allow repository access, code tampering, tag manipulation, or broader organization compromise depending on its scopes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration grants capabilities well beyond simple release-tag creation, including deployment notifications, wiki/document integration, and Jenkins job control. This expands the skill’s authority and attack surface so that compromise or misuse of the skill could trigger downstream operational actions unrelated to its declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The Feishu app secret is directly embedded in the configuration, which can enable unauthorized API access when combined with the app ID. This may allow impersonation of the integration, access to workspace resources, or abuse of connected wiki/chat capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A Jenkins API token is hardcoded in the config, enabling direct authenticated access to CI/CD infrastructure if obtained. Because the same file also includes Jenkins URL, username, and job templates, an attacker has enough context to trigger jobs, manipulate pipelines, or potentially reach deployment systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of a shell script that performs real git push operations and GitHub API release creation, but it declares no explicit tool/permission scope. That mismatch increases the chance an agent may invoke shell, file access, or networked GitHub actions without enforceable least-privilege boundaries, which is especially risky because the workflow can write to multiple remote repositories and use a GitHub token.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill description and operational instructions are written only in Chinese, including user-facing reply guidance such as '回复里应尽量补充以下信息'. This indicates a language constraint for operation/output without documenting any user choice or opt-in, which matches the locale/language policy violation criterion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Embedding Feishu webhook, app, and wiki integration in a tag-release skill violates least privilege because the skill can interact with external messaging/documentation systems without that being necessary for tagging. If abused, these integrations could send unauthorized notifications, leak operational metadata, or alter collaboration resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Feishu bot webhook URL is a sensitive integration endpoint that allows sending messages into organizational chatops channels if disclosed. Attackers could abuse it for spoofed deployment notifications, phishing, alert fatigue, or leaking internal operational context through automated posts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Jenkins control parameters and API credentials in a tag-release skill create an unnecessary path from source-control actions into CI/CD execution. In context, this is more dangerous because tagging often implies release workflows, so an attacker or prompt-injection path could potentially trigger builds/deployments under the guise of a benign tag operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module docstring claims the allowed capability is limited to querying/creating tags, but the code also writes Releases through /releases. This mismatch can mislead reviewers and users about what privileged actions the script performs, making unsafe approval or overbroad token use more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata says the capability is for creating release tags, but the implementation also creates GitHub Releases via the API. This is a scope-expansion issue: an operator expecting a narrowly scoped tagging tool may unknowingly grant it permissions to publish releases and release notes, increasing blast radius and violating least privilege.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tag_release.py (reported line 96)May include surrounding context.

python

def run_git(repo_dir: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
    result = subprocess.run(
        ["git", *args],
        cwd=repo_dir,
        capture_output=True,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tag_release.py (reported line 174)May include surrounding context.

python

"Authorization": "Bearer {}".format(token),
        "X-GitHub-Api-Version": "2022-11-28",
    }
    resp = requests.post(url, headers=headers, json=payload, timeout=20)
    if resp.status_code >= 400:
        raise RuntimeError("GitHub API {} 失败: HTTP {} {}".format(path, resp.status_code, resp.text[:200]))
    return resp.json()

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

文档把默认行为描述为通过仓库语义“创建 annotated tag，并 push 到 origin”，给人的实现预期是本地 git 打 tag 后推送。实际主流程没有使用 git push，甚至几乎不使用本地仓库，而是直接通过 GitHub API 写入远程 tag/ref，并额外创建 release。该文档与实际执行方式存在明显偏差。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.