Gh Address Comments

• Outcome: Review
• Latest audit: Jun 7, 2026 at 2:20 PM UTC
• Version:
  1.0.0

Overview

The skill appears intended for GitHub PR maintenance, but it asks for broad GitHub CLI scopes and elevated command access beyond what is clearly necessary.

Review this skill before installing if you use GitHub credentials with access to private or sensitive repositories. Prefer using the minimum gh scopes needed for the target repository, avoid granting workflow scope unless you explicitly need it, and run the helper only on PRs whose comments you are comfortable exposing to the local agent context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of shell-based `gh` commands with elevated network access and escalated sandbox permissions, but it does not declare any permissions. This creates a trust and review gap: operators may invoke networked shell actions and authentication flows without clear permission disclosure, increasing the chance of unintended data access or execution beyond the stated security model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill claims to help address PR comments, but the described behavior primarily fetches and enumerates PR comments and review data, including use of direct GitHub API access and structured export, without clearly implementing the 'address' phase. This mismatch is dangerous because it can cause users to authorize broader access or disclose repository review metadata under misleading expectations about the skill's purpose.

VirusTotal

65/65 vendors flagged this skill as clean.